topic The questions about the Certificate Truststore in ONTAP? in ONTAP Discussions

The questions about the Certificate Truststore in ONTAP?

Terry-xiao — Wed, 04 Jun 2025 09:58:38 GMT

Hi expert、

The following KB mentioned that "The Truststore Certificates are installed only on the admin SVM during an ONTAP install of 9.2, or during an upgrade to ONTAP 9.2."

It also mentioned that the Truststore Certificates are automatically updated as needed as part of every ONTAP release.

Could you please give information what is the action if the Truststore Certificate will expire?

Do we need to upgrade the ontap release to the new one to update the expired one to the latest Certificates ?

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
What is the Certificate Truststore in ONTAP?
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_is_the_Certificate_Truststore_in_ONTAP

Can we create the Truststore Certificate with a new expiration date?
No, the new certificate must be technically re-issued by the Certificate Authority, and then re-installed. But as mentioned above, the Truststore Certificates are automatically updated as needed as part of every ONTAP release.
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

Thanks and regards
wenhai

Re: The questions about the Certificate Truststore in ONTAP?

AlexDawson — Wed, 13 Jul 2022 02:30:11 GMT

> Could you please give information what is the action if the Truststore Certificate will expire?

Autosupport or other outbound connections to secure services such as SSL mail services may stop working.

> Do we need to upgrade the ontap release to the new one to update the expired one to the latest Certificates ?

Yes.

Hope this helps!

Re: The questions about the Certificate Truststore in ONTAP?

chamfer — Wed, 13 Jul 2022 04:30:29 GMT

Hi Wenhai,

Just building on what AlexDawson has provided......

There are multiple certificates in the Truststore and they are all root certificates, depending on what service has a dependency on the root certificate would probably stop working when the certificate expires. You should not have a signed certificate (via CSR) from a root/signing CA with a validity that exceeds the root/signing CA expiration date.

AutoSupport uses the "AAACertificateServices" CA which should expire at the end of 2028. More detail is here https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_will_happen_when_my_Autosupport_Certificate_in_ONTAP_expires%3F

Re: The questions about the Certificate Truststore in ONTAP?

Terry-xiao — Mon, 01 Aug 2022 04:33:17 GMT

Hi ,thanks very much for update.

Regarding "upgrading the ontap release to the new one to update the expired one to the latest Truststore Certificate.

if the system is running version ontap 9.8P5,and update it to the 9.8P12,does the expired one will updaded by ontap version up ? do we need to update the current version to the latest one 9.10.1 to update the certificate?

Also can we perform this version up before any "Truststore Certificate" will expire?

Thanks and regards
Terry