{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "item": { "id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "slug": "plan-pfsense-certificate-renewal-as-a-distribution-and-service-event", "url": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event.md", "json": "https://update.dsesecurity.com/api/v1/posts/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/" }, "title": "Plan pfSense certificate renewal as a distribution and service event", "summary": "Updating the certificate entry can restart local services and still require exporting new user material.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:13+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 260, "potentially_affected": "This concerns pfSense's internal-CA Renew or Reissue workflow.", "dse_recommendation": "DSE recommends inventorying every service and client that consumes the certificate before reissuing it.", "primary_source": { "name": "Netgate — Renew or Reissue a CA or Certificate", "url": "https://docs.netgate.com/pfsense/en/latest/certificates/renew.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Updating the certificate entry can restart local services and still require exporting new user material.

\n

Source facts

\n

Netgate documents separate options to reuse a key or serial during certificate renewal. Server and user certificates generally need a new serial, while CA handling differs. Services using a renewed local certificate restart automatically. Updated user certificates must be exported and delivered again, and a newly generated private key must accompany the corresponding certificate securely.

\n

Source: Netgate — Renew or Reissue a CA or Certificate.

\n

Applicability

\n

This concerns pfSense’s internal-CA Renew or Reissue workflow.

\n

DSE recommendation

\n

DSE recommends inventorying every service and client that consumes the certificate before reissuing it. Decide key reuse and serial handling explicitly, preserve the old material under the retention policy, and schedule local-service interruption. Prepare a controlled user-distribution channel and avoid emailing private keys as ordinary attachments. For CA changes, review dependent trust separately rather than applying the server-certificate rule without checking its consequences. Maintain a distribution list for the renewed user material and nominate the services whose restart needs an approved window. Require one remote user to complete the agreed reconnect check with the new material before marking distribution complete; keep certificate issuance and endpoint rollout as separate milestones.

\n

Verification

\n

In rehearsal, renew a designated nonproduction certificate and confirm the new serial, validity, and expected key relationship. Verify local service recovery and one representative client connection. For user certificates, confirm the updated client package was installed and works, then retire obsolete material through the approved process.

\n

Official reference

\n

Netgate — Renew or Reissue a CA or Certificate. Reviewed October 20, 2026.

", "content_text": "Updating the certificate entry can restart local services and still require exporting new user material.\nSource facts\nNetgate documents separate options to reuse a key or serial during certificate renewal. Server and user certificates generally need a new serial, while CA handling differs. Services using a renewed local certificate restart automatically. Updated user certificates must be exported and delivered again, and a newly generated private key must accompany the corresponding certificate securely.\nSource: Netgate — Renew or Reissue a CA or Certificate.\nApplicability\nThis concerns pfSense’s internal-CA Renew or Reissue workflow.\nDSE recommendation\nDSE recommends inventorying every service and client that consumes the certificate before reissuing it. Decide key reuse and serial handling explicitly, preserve the old material under the retention policy, and schedule local-service interruption. Prepare a controlled user-distribution channel and avoid emailing private keys as ordinary attachments. For CA changes, review dependent trust separately rather than applying the server-certificate rule without checking its consequences. Maintain a distribution list for the renewed user material and nominate the services whose restart needs an approved window. Require one remote user to complete the agreed reconnect check with the new material before marking distribution complete; keep certificate issuance and endpoint rollout as separate milestones.\nVerification\nIn rehearsal, renew a designated nonproduction certificate and confirm the new serial, validity, and expected key relationship. Verify local service recovery and one representative client connection. For user certificates, confirm the updated client package was installed and works, then retire obsolete material through the approved process.\nOfficial reference\nNetgate — Renew or Reissue a CA or Certificate. Reviewed October 20, 2026.", "content_markdown": "Updating the certificate entry can restart local services and still require exporting new user material.\n\n## Source facts\n\nNetgate documents separate options to reuse a key or serial during certificate renewal. Server and user certificates generally need a new serial, while CA handling differs. Services using a renewed local certificate restart automatically. Updated user certificates must be exported and delivered again, and a newly generated private key must accompany the corresponding certificate securely.\n\nSource: [Netgate — Renew or Reissue a CA or Certificate](https://docs.netgate.com/pfsense/en/latest/certificates/renew.html).\n\n## Applicability\n\nThis concerns pfSense’s internal-CA Renew or Reissue workflow.\n\n## DSE recommendation\n\nDSE recommends inventorying every service and client that consumes the certificate before reissuing it. Decide key reuse and serial handling explicitly, preserve the old material under the retention policy, and schedule local-service interruption. Prepare a controlled user-distribution channel and avoid emailing private keys as ordinary attachments. For CA changes, review dependent trust separately rather than applying the server-certificate rule without checking its consequences. Maintain a distribution list for the renewed user material and nominate the services whose restart needs an approved window. Require one remote user to complete the agreed reconnect check with the new material before marking distribution complete; keep certificate issuance and endpoint rollout as separate milestones.\n\n## Verification\n\nIn rehearsal, renew a designated nonproduction certificate and confirm the new serial, validity, and expected key relationship. Verify local service recovery and one representative client connection. For user certificates, confirm the updated client package was installed and works, then retire obsolete material through the approved process.\n\n## Official reference\n\n[Netgate — Renew or Reissue a CA or Certificate](https://docs.netgate.com/pfsense/en/latest/certificates/renew.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "url": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Plan pfSense certificate renewal as a distribution and service event", "item": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/#article", "identifier": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "url": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/", "headline": "Plan pfSense certificate renewal as a distribution and service event", "description": "Updating the certificate entry can restart local services and still require exporting new user material.", "abstract": "Updating the certificate entry can restart local services and still require exporting new user material.", "articleBody": "Updating the certificate entry can restart local services and still require exporting new user material.\nSource facts\nNetgate documents separate options to reuse a key or serial during certificate renewal. Server and user certificates generally need a new serial, while CA handling differs. Services using a renewed local certificate restart automatically. Updated user certificates must be exported and delivered again, and a newly generated private key must accompany the corresponding certificate securely.\nSource: Netgate — Renew or Reissue a CA or Certificate.\nApplicability\nThis concerns pfSense’s internal-CA Renew or Reissue workflow.\nDSE recommendation\nDSE recommends inventorying every service and client that consumes the certificate before reissuing it. Decide key reuse and serial handling explicitly, preserve the old material under the retention policy, and schedule local-service interruption. Prepare a controlled user-distribution channel and avoid emailing private keys as ordinary attachments. For CA changes, review dependent trust separately rather than applying the server-certificate rule without checking its consequences. Maintain a distribution list for the renewed user material and nominate the services whose restart needs an approved window. Require one remote user to complete the agreed reconnect check with the new material before marking distribution complete; keep certificate issuance and endpoint rollout as separate milestones.\nVerification\nIn rehearsal, renew a designated nonproduction certificate and confirm the new serial, validity, and expected key relationship. Verify local service recovery and one representative client connection. For user certificates, confirm the updated client package was installed and works, then retire obsolete material through the approved process.\nOfficial reference\nNetgate — Renew or Reissue a CA or Certificate. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:13+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/plan-pfsense-certificate-renewal-as-a-distribution-and-service-event/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan pfSense certificate renewal as a distribution and service event" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Renew or Reissue a CA or Certificate", "url": "https://docs.netgate.com/pfsense/en/latest/certificates/renew.html" } } ] } }