CA expired

[JiriPrchal]

Hi, at first, please apologize me writing here, but I didn't find where to place "question".
So this is not real issue, it's a question.
What happened to my vpn setup - 1 server and 100+ clients:
I renew server and clients certs and distributed them to all clients. Everything was OK until CA expired last week. Till that I didn't had knowledge that CA has limited lifetime too, since it is not clear text written in it. So now all clients are disconnected and it was only way to them, they are behind NAT, no staff at sites. So my question is if there is any temporarily bypass of CA check setting at server side?
Thank for any help.

[schwabe]

if you still have the CA key you can regenerate the CA certificate with longer lifetimes, or you can use peer-fingerprint instead of a CA, which ignores lifetimes. However, doing this on the server side will probably not help you much in your situation as the clients will probably also have an expired CA as they also check the server side. So they will most likely refuse to connect to your server without being given a new CA certificate as well.

[JiriPrchal]

Sure, I regenerated CA using old key. But how to "push" new CA to clients?
Nice option peer-fingerprint, good to know for next time...

[schwabe]

@JiriPrchal there is no "push" to client. You will have to modify their configuration.

[LisaGMacias]

SPAM