OPC Server certificate expiry

[vinodpydi]

Could you please help me on the certificate expiry. We have followed the folder structure as per the standards and CTT tests.

When OPC server starts - pki folder structure is created and our DA server certificate will create automatically and will save in the "OWN" folder and "trusted" folder.

Question is when OPC DA certificate expires after 1 year - i have the below questions

Is it mandatory to restart the OPC Server application to regenerate the new certificates from the stack?
Do we need to delete the certificate from the "OWN" folder after the expiry and then restart if it is mandatory?
How can we test the expiry of the certificate (if we change the system time and date intentionally will it work? hope it will give us error stating "Bad certificate time invalid"?)
Please help us to answer to these question to go forward. Thank you.

[mregen]

Hi @vinodpydi, currently the server requires a restart to use a new certificate, but it will keep using an expired certificate until renewed.
There is a helper function to Delete the application certificate, so it can be renewed on next restart.
But it also means all clients lose trust for secure connections. Only an administrator should start thenrenewal.
Another option is to use the GDS push support to update a certificate.
It updates the certificate in operation. You could follow the same process from your application to force closing of all connections and to Update the application certificate.
All endpoints also need to be updated to include the updated certificate.