Centrally managed Spark appliance and VPN certificates

[David_C1]

We use SmartProvisioning to manage 25 or so Spark appliances. These appliances are used as satellite gateways in a VPN community, with the center gateways managed by the same SMS. I cannot find a way to determine the age/expiration date of the VPN certificate generated by the SMS (in SmartProvisioning). Here is a screenshot of the VPN tab where the cert is generated:

As you can see, no details available. The webUI of the Spark appliance does show installed certificates, but the certs shown here are the locally generated certificates.

Is there a way to see the details of the certificate generated in SmartProvisioning, which is actually used for the VPN authentication?

Thanks,

David

[PhoneBoy]

The local WebUI will only show you local certificates, I believe.
Might need to use cpca_client lscert from Expert Mode.

[David_C1]

Phoneboy - you are correct, local WebUI only shows local certificates (something not very helpful with centrally managed gateways) and the command you provided does show me what I need to see - thank you for that.

That being said, it would be nice if the certificate view in SmartProvisioning had same features as in SmartConsole, where you can actually see details of the cert.

Dave

[David_C1]

Bad form I know to reply to my own post, but follow up question:

cpca_client lscert shows me the certs that the CA has issued (including expired, revoked certs).  There are many examples of numerous certs issued for the same gateway, same function. How do I know which cert the client is actually using? If one cert is expired, one is valid, I can assume that the gateway is using the valid cert? Or is there some way on the client side I can verify?

Dave

[PhoneBoy]

Only valid certs should be used.
To see which one is actually used, a debug might be required.