Renewing SSL certificate on ASA for VPN (2048 bit, versus 1024) 1

[hinesjrh]

I have an SSL certificate on my ASA 5520 (running 8.3(2)) code that is expiring soon. My current certificate that was installed a few years ago was created with a key pair bit size of 1024. My certificate authority will only issue certs now with a minimum key pair bit size of 2048. Via the ASDM the only way I can see to renew this certificate is to generate a 'new' identity certificate so I can create the CSR with a 2048 bit size, but in doing so it seems to force me to enter a new key pair name saying the current one (with the 1024 bit size) already exists. How can I create a CSR with a 2048 bit size and yet keep the same key pair name? Are any of you aware of Cisco documentation that addresses this?

 

[FaiTHLeSS]

I think you would have to delete the existing key pair if you want to use the same name. It would be easier just to create a new pair then re-assign the trustpoint once you have the new cert ready.

This is what i did recently, once you have the new cert in place go to device management - Advanced - SSL Settings, here you can edit where the trustpoints are assigned to.