Managing CA rotation

This page explains how you can manage the rotation of a CA in a CA pool. For more information about CA pools, see Overview of CA pools.

Note: This document provides general guidance on managing CA rotation. We recommend that organizations carefully construct their processes in consultation with security experts.

Ensure seamless CA rotation

Ensuring seamless CA rotation is essential to avoid service downtime, or to deal with an emergency. The following procedure explains how you can seamlessly rotate a CA.

1. Find the CA pool for the existing CA that is due to expire.

2. Create a CA in the same CA pool. The CA is created in the STAGED state and cannot issue certificates through CA pool load-balancing. CAs in the STAGED state can only issue certificates when requested directly by the clients. For more information about CA states, see CA states.

3. Ensure that all clients have downloaded the latest set of CA certificates from the CA pool.

   Note: Verify that all your clients have received the new certificates. The clients must use the fetchCaCerts API to retrieve the CA certificates. If you have configured your clients to automatically download the latest set of certificates from the CA pool, then you have to wait until all your clients get the new certificates. Otherwise, you can explicitly publish the new set of certificates to your clients.

4. Change the state of the new CA to ENABLED. This ensures that certificates can be issued from both the old and the new CA. For information about enabling certificate authorities, see Enable a CA.

   Note: To ensure that the new certificates aren't causing outages, you can now choose to wait and monitor your environment.

5. Change the state of the old CA to DISABLED. This ensures that certificates won't be issued by the old CA. For information about disabling certificate authorities, see Disable a CA.

   Note: CAs in the DISABLED state are still trusted by the clients and provided in the trust anchor for the CA pool.

6. Wait until all clients have stopped using the certificates issued from the old CA. You can ensure that in two ways:

   • You can wait for the maximum certificate lifetime.
   • You can monitor the certificates being used by your clients.

7. Delete the old CA. For more information about deleting a CA, see Delete certificate authorities.

What's next

• Learn more about CA states.
• Learn how to manage CA states.
• Learn how to update CAs.