Renew using new keys
Renew certificates by replacing their existing key pairs with new key pairs. This renewal method requires you to upload a ZIP archive containing new CSRs for the devices that you want to renew.
Use this option when your organization's security policy or compliance requirements require key rotation as part of the certificate renewal process.
Suggerimento
This renewal method is required when the certificate profile is configured with New keypair required for renewal = Always. If the certificate profile is configured as Optional, you can choose either to renew using existing keys or to renew using new keys.
Before you begin
Generate new CSRs for the devices that require certificate renewal and package them into a ZIP archive
Name each CSR file using the device's original unique identifier as shown in the example:
<unique_identifier>.csr
Device Trust Manager uses the unique identifier to match each CSR to the corresponding certificate record in the source batch enrollment job.
In the Device Trust Manager, go to Jobs > Batch certificates.
All the Batch certificate jobs are listed in a table format.
Select the Batch certificate job to renew its associated certificates in bulk.
Select More actions > Renew batch.
Chose Renew using new keys to renew every eligible certificate in this batch job using new key pair.
Under Upload CSR ZIP, upload a ZIP archive with individual CSR files.
Select Start renewal.
What happens next
When the renewal job starts, Device Trust Manager automatically matches each uploaded CSR to the corresponding device record from the original batch enrollment job
Device Trust Manager creates a renewal batch job and processes all matched CSRs. If a CSR can't be matched to a device record from the source enrollment job, Device Trust Manager skips that entry and continues processing the remaining requests
The batch job is renewed with every eligible certificate using its new key pair
To see the renwed batch job, go to Jobs > Batch certificates to see its Status
To download the batch report in a CSV format, go to Jobs > Batch certificates > select the renewed batch job > More actions > Download batch report