Avoid fingerprint warning after certificate renewal

[Cihat_Bulut]

Hello,

If you don’t want VPN clients to receive warnings every time the server certificate changes, don’t import only the server certificate. Instead, include the root and intermediate certificates within the server certificate itself. You can do this using the command below.

Assume you have one SubCA: 

cat SubCA.crt rootCA.crt >> fullchain.crt 

cpopenssl pkcs12 -export -inkey private.key  -in cert.crt   -certfile fullchain.crt   -name "myCert"   -out mycert.p12

Import this file into the Mobile Portal. The fingerprint shown will correspond to the Root CA.

After this, you won’t see any warnings as long as the Root CA remains the same.

[the_rock]

Excellent, thank you for that @Cihat_Bulut 

[Lesley]

Thanks for the tip first of all.

Only thing I would like to add if you use a fail chain will give an anchor warning in SSL labs. 

Instructions

When scanning through SSL Labs, it shows "Chain issues  Contains anchor"

It means that you have added Intermediate as well as Root CA, when you only need the Intermediate as the client will already have Root CA (will be already trusted by browser in browser certificate store).

It's not an issue in the sense that the anchor is not allowed, but that the extra certificate (which serves no purpose) is increasing the handshake latency. 

Because of TCP slow start, the first bytes on a connection are the slowest. Hence, you can minimize the size of the handshake so that HTTP bytes can start flowing as soon as possible. So the issue is not so much "can the extra certificate fit into the initial window" (it most likely can, even with the old setting of 3 network segments), but "what other, more useful, data could we be sending instead".

Also this sk is relevant for fingerprints: https://support.checkpoint.com/results/sk/sk66263

[the_rock]

Excellent points @Lesley