System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PKI certificate expiry notifications

Updated: September 18, 2026

Want to summarize with AI?

Details the entire PKI certificate lifecycle, including certificate enrollment, renewal, revocation, and validation processes, with guidance on ensuring continuous authentication and robust network security.

A PKI certificate expiry notification is a trust infrastructure mechanism that

alerts administrators when a public key infrastructure (PKI) certificate is approaching its expiry date
uses SNMP traps and syslog messages to deliver notification events, and
supports certificate authority interoperability in Cisco IOS XR deployments.

Additional reference information

PKI certificate expiry notifications help ensure proactive renewal of certificates, reducing the risk of service interruption or trust failures. Notifications are triggered based on approaching expiry dates and can be customized or integrated to support operational workflows.

When a PKI certificate is about to expire, the Cisco IOS XR device sends an SNMP trap and a syslog message to the configured monitoring system.

Counter-example

If the certificate is revoked or disabled, no expiry notification is sent; the expiring certificate must still be valid for notification to be triggered.

PKI alert notifications

A PKI alert notification is a certificate authority interoperability component that

provides timely alerts when certificates used by Cisco IOS XR applications are nearing expiry
supports certificate-based authentication and trust for routers, and
enhances operational awareness by notifying administrators through syslog and SNMP traps, ensuring seamless service continuity.

PKI traps retrieve certificate information from devices in the network and send SNMP traps at regular intervals to the network management system, based on thresholds configured on the device.
An SNMP trap (certificate expiry notification) is sent to the SNMP server at intervals starting from 60 days to one week before the certificate end date.

Additional reference information

Certificates are essential for authenticating routers in Cisco IOS XR deployments. If a certificate expires, it becomes invalid and can disrupt services such as Crosswork Trust Insights, Internet Key Exchange version 2 (IKEv2), dot1x, and others. PKI alert notifications ensure administrators are informed of impending certificate expiry, reducing risk to critical network functions.

Alert notifications are sent in the following modes and intervals:

First notification: Sent 60 days before certificate expiry; warning mode.
Repeated notifications: Sent every week until one week before expiry; warning mode.
Last notification: Sent every day within the final week before expiry; alert mode.

The notifications include the following information:

Certificate serial number
Certificate issuer name
Trustpoint name
Certificate type
Number of days remaining for the certificate to expire
Certificate subject name

Sample syslog message

%SECURITY-CEPKI-1-CERT_EXPIRING_ALERT : Certificate expiring WITHIN A WEEK.
Trustpoint Name= check, Certificate Type= ID, Serial Number= 02:EC,
Issuer Name= CN=cacert,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN, Subject name= CN=cisco.com,
Time Left= 1 days, 23 hours, 59 minutes, 41 seconds

Notification Intervals and Modes


Interval	Description	Notification Mode
First notification	Sent 60 days before certificate expiry	Warning
Repeated notifications	Sent weekly until one week before expiry	Warning
Last notification	Sent daily within the final week before expiry	Alert

PKI credentials expiry alerts

PKI alert notifications are not sent for:

Secure Unique Device Identifier (SUDI) certificates
Certificates in a trustpool (trustpools have their own expiry alerts mechanism)
Trustpoint clones
Certificate authority (CA) certificates without an associated router certificate
Certificates with key usage keys

Requirement: Follow PKI credential expiry alert restrictions

To ensure PKI credential expiry alert restrictions remain supported:

You cannot disable this feature, and it requires no additional configuration tasks.
To enable PKI traps, use the command snmp-server traps pki . If SNMP is already configured, the SNMP trap will use the same PKI expiry timer.
Verification: Run show runn snmp-server traps to confirm that PKI traps are enabled.

Regenerate PKI certificates

Regenerate PKI certificates to maintain secure authentication and enable certificate authority interoperability when an existing certificate expires.

When a PKI certificate expires, it becomes invalid and must be regenerated to keep secure communications functioning. You will usually receive an expiry notification, prompting this task. Regenerating certificates ensures ongoing trust between network devices and certificate authorities.

Before you begin

Review certificate authority prerequisites and ensure you understand any site-specific requirements.
Confirm you have access to your router and know the trustpoint name used for PKI certificates.

Procedure

Clear the existing certificate connected to the trustpoint.

Example:

Router# clear crypto ca certificates [trustpoint-name]

Example:

Router# clear crypto ca certificates myca

Example:

Clear the existing certificate using the following command:

For example,

(Recommended) Regenerate a new keypair for the configured trustpoint label.

Example:

Router# crypto key generate rsa [keypair-label]

Example:

Router# crypto key generate rsa mykey
The name for the keys will be: mykey
% You already have keys defined for mykey
Do you really want to replace them? [yes/no]: yes
  Choose the size of the key modulus in the range of 512 to 4096 for your General Purpose Keypair. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [2048]:
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]The name for the keys will be: mykey
% You already have keys defined for mykey
Do you really want to replace them? [yes/no]: yes
  Choose the size of the key modulus in the range of 512 to 4096 for your General Purpose Keypair. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [2048]:
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]

If prompted to replace existing keys or select key size, accept defaults or enter the required values.

For example,

Reenroll the certificate.
Example:
```
Router# crypto ca authenticate [trustpoint-name]
Router# crypto ca enroll [trustpoint-name]
```
Example:
```
Router# crypto ca authenticate myca
Router# crypto ca enroll myca
```
Reenroll the certificate using the following command. For more information, see Obtain router certificates for your router section.

PKI certificates are successfully regenerated and the device resumes secure connectivity with the certificate authority.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.