Plan pfSense certificate renewal as a distribution and service event

Updating the certificate entry can restart local services and still require exporting new user material.

Source facts

Netgate documents separate options to reuse a key or serial during certificate renewal. Server and user certificates generally need a new serial, while CA handling differs. Services using a renewed local certificate restart automatically. Updated user certificates must be exported and delivered again, and a newly generated private key must accompany the corresponding certificate securely.

Source: Netgate — Renew or Reissue a CA or Certificate.

Applicability

This concerns pfSense’s internal-CA Renew or Reissue workflow.

DSE recommendation

DSE recommends inventorying every service and client that consumes the certificate before reissuing it. Decide key reuse and serial handling explicitly, preserve the old material under the retention policy, and schedule local-service interruption. Prepare a controlled user-distribution channel and avoid emailing private keys as ordinary attachments. For CA changes, review dependent trust separately rather than applying the server-certificate rule without checking its consequences. Maintain a distribution list for the renewed user material and nominate the services whose restart needs an approved window. Require one remote user to complete the agreed reconnect check with the new material before marking distribution complete; keep certificate issuance and endpoint rollout as separate milestones.

Verification

In rehearsal, renew a designated nonproduction certificate and confirm the new serial, validity, and expected key relationship. Verify local service recovery and one representative client connection. For user certificates, confirm the updated client package was installed and works, then retire obsolete material through the approved process.

Official reference

Netgate — Renew or Reissue a CA or Certificate. Reviewed October 20, 2026.