IKE reauthentication and certificate expiry handling

[krishnamurthyvd]

In our strongswan IKE deployment, we have certificates placed under /etc/ipsec.d. We have reauthentication enabled once every 4 hrs.
We intend to refresh the certs every 3 months. Basically certs expire every 3 months. The new certs are placed under same /etc/ipsec.d. So the question here is that

1. Will IKE drop the IKE session during re-authentication if the certs have expired?
2. Will IKE reload/read the new certs during reauthentication or should the new certs be reloaded manually ?

[Thermi]

1. Only the remote's certs are checked.
2. The latter, and the expired local cert should be removed beforehand. The certificate files do not need to persist after they were initially read by the daemon. They are kept in memory.

[krishnamurthyvd]

So the old certs need to be replaced and new certs reloaded before the reauthentication starts. Is that right? There is no option to reload it as IKE knows that a cert has expired?

[Thermi]

Exactly.