Cisco Catalyst SD-WAN Certificate Management Guide, Releases 26.x and Later

Expired certificate indication and quarantine

Updated: June 8, 2026

Want to summarize with AI?

Describes how SD-WAN Manager checks devices for expired certificates and quarantines devices that require a certificate renewal.

Indication of expired certificates

A digital certificate is used to authenticate devices in the overlay network. After authentication, devices and Cisco Catalyst SD-WAN Control Components can establish secure sessions with one another. A certificate is issued by a certificate authority and has an expiration date.

Every several minutes, SD-WAN Manager checks the devices and Cisco Catalyst SD-WAN Control Components in the network for expired certificates. If it detects any expired certificates, SD-WAN Manager displays a banner with a link to the Configuration > Certificates > WAN Edges page or Configuration > Certificates > Control Components page to show the details of which devices or components require certificate renewal.

Note

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.18.1a, the SD-WAN Manager UI parses certificate expiration dates by using the expirationdatelong command, which uses the epoch time standard, ensuring consistency across all time zones.

Device quarantine

Quarantine refers to placing devices into a staging state. Quarantined devices keep their control connections to SD-WAN Control Components, but do not handle data plane traffic.

You can quarantine devices that have expired certificates. Refer to Enable quarantining devices with expired certificates.

Quarantining devices with expired certificates enforces the requirement to renew an expired certificate. Removing network elements with expired certificates may be necessary to comply with an organization's network security requirements.

This table shows which devices are subject to automatic quarantine when the quarantine feature is enabled.

Table 1. Automatic quarantine for expired certificate
Device or SD-WAN Control Component	Automatic quarantine when quarantine enabled?
Hardware devices using a certificate	Yes
Hardware devices using an on-box trusted platform module (TPM) secure unique device identifier (SUDI) certificate	No
Software devices	Yes
SD-WAN Control Components	No

Multitenancy

In a multitenancy scenario, enabling quarantine for expired certificates is possible only at the provider level and applies to all tenants.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.