@AntonyWardle (Customer)​ ,

If you replace RSA's self-signed certificates on your primary Authentication Manager server, best practice would be to replace the certificates on your replicas as well. If, for some reason, you need to promote a replica to primary as part of a promotion for maintenance, the promotion will fail because of a cert mismatch.

Note that if you replaced the certs on the primary with certs from a CA named CA_1, then all replacements certs should be from the same CA; again because server maintenance, like promotions will fail if the cert on the replica you want to promote is from CA_2.

Can you explain in more detail what you mean when you said "if the primary moves around between the nodes?" Are you referring to testing promoting servers or something else?

Hi

thanks for the answer.

Web browsers complain if you have a self-signed cert. I hate errors.

Certificates should be SAN certificates.

Say I create a cname called rsa-prod, I put that and the fqdn in my request along with host name of the primary node and the get that signed. We then need to do some maintenance somewhere and decide we need to make a replica a primary, what happens with the certificate? We update the cname for the new host, but then host isn't in the certificate unless I add all of them at the start.

I hope this makes sense. I also raise a support case, but they didn't read the ticket and sent me a kb which wasn't relevant.

Antony