Change the certificate for Remote Access VPN

[Ob1lan]

Hi,

We have 2 clusters (ClusterXL active/standby) that we use as VPN gateways for our Remote Access users. Both are R81.10, and one of the clusters is also used as S2S VPN gateway for tunnels with various 3rd parties.

Now we enabled SAML authentication, we want to advertise this authentication method to all our users. 

However, we have a certificate warning every time we login, as the IPSEC certificate on the gateways is issued by the internal_ca. I'd like to install a trusted CA, so our internal users and partners/vendors can connect without a certificate warning. So the certificate should have 'vpn.company.com' as object, and the public IP of both clusters in the SAN.

How can I achieve that without disrupting the existing numerous IPSEC S2S we also have with many 3rd parties ? Is there anything I need to pay attention to, to avoid possible issues ?

Thanks for your advices, as always.