# PSA: open-balena certificates expiration management

**URL:** <https://forums.balena.io/t/psa-open-balena-certificates-expiration-management/350177>\
**Category:** openBalena\
**Created:** [November 18, 2021, 10:42am UTC](https://forums.balena.io/t/psa-open-balena-certificates-expiration-management/350177 "2021-11-18T10:42:49Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![dash](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dash](https://forums.balena.io/u/dash)\
**Post date:** [November 20, 2021, 6:00am UTC](https://forums.balena.io/t/psa-open-balena-certificates-expiration-management/350177/2 "2021-11-20T06:00:38Z")

</div>

Hi @AndreaAlgeri

You can renew the certificates easily enough.

This is a procedure I documented for myself a while back. Its included in a post on here somewhere:

1. Rename the following files in the config/certs/vpn folder to create a backup.

- issued/vpn.mydomain.com.crt
- private/vpn.mydomain.com.key
- reqs/vpn.mydomain.com.req
- index.txt

1. Download easy-rsa to a temporary folder and extract it with following command:

> $ curl -sL [https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz](https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz) | tar xz --strip-components=1

1. Create new certificate:

> $ ./easyrsa/easyrsa --pki-dir=“./vpn” --days=730 build-server-full “[vpn.mydomain.com](http://vpn.mydomain.com)” nopass

1. Convert certificate and the key-file base64 string:

```auto
$ echo "$(cat ./vpn/issued/vpn.mydomain.com.crt)" | base64 --wrap=0 2>/dev/null
$ echo "$(cat ./vpn/private/vpn.mydomain.com.key)" | base64 --wrap=0 2>/dev/null

```

1. Replace the values of the keys OPENBALENA\_VPN\_SERVER\_CRT and OPENBALENA\_VPN\_SERVER\_KEY in config/activate with base64 encoded values from step 4.

2. Restart open balena and recreate services.

> $ ./scripts/compose up -d --force-recreate --no-deps

No warranty provided obviously but I have done this a couple of time and not had any impacts on fleet devices.

EDIT: I think this works in pepertuality provided you always generate the new certificates with the same CA. This because the devices have the CA set in their config.json file to trust. You could of course change the CA in the config.json of all fleet devices if you really had to using a script. Theres an example of how to bulk edit config.json of fleet devices on the balena GitHub. Would avoid that unless truly necessary.

Cheers  
Dashals

---

_[View the full topic](https://forums.balena.io/t/psa-open-balena-certificates-expiration-management/350177)._