# Best practices: Certificate Rotation

**URL:** <https://hub.mender.io/t/best-practices-certificate-rotation/3439>\
**Category:** General Discussions\
**Created:** [March 29, 2021, 3:22pm UTC](https://hub.mender.io/t/best-practices-certificate-rotation/3439 "2021-03-29T15:22:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmeirow](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@jmeirow](https://hub.mender.io/u/jmeirow)\
**Post date:** [March 29, 2021, 3:22pm UTC](https://hub.mender.io/t/best-practices-certificate-rotation/3439/1 "2021-03-29T15:22:16Z")

</div>

Has anyone established a pattern or best practice for updating devices with new CA-signed certs? I am asking specifically about self-hosted version of Mender server.

For instance, if an organization receives their new CA-signed cert, do they append them to the current server.crt and send out the new server.crt to all devices? And then when it is certain that all devices have the new server.crt (with both the old and new CA-signed cert chains), they can install the new certificate on the server without the devices losing connectivity?

Is there a better way than this?

---

<div class="post-metadata">

**Author:** ![drewmoseley](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/drewmoseley/32/47_2.png) [@drewmoseley](https://hub.mender.io/u/drewmoseley)\
**Post date:** [March 29, 2021, 4:04pm UTC](https://hub.mender.io/t/best-practices-certificate-rotation/3439/2 "2021-03-29T16:04:57Z")

</div>

Hi @jmeirow that’s definitely been my understanding of how to rotate certificates. I would love to hear if others are doing anything substantially different.

Drew

---

<div class="post-metadata">

**Author:** ![dellgreen](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/dellgreen/32/85_2.png) [@dellgreen](https://hub.mender.io/u/dellgreen)\
**Post date:** [March 29, 2021, 4:25pm UTC](https://hub.mender.io/t/best-practices-certificate-rotation/3439/3 "2021-03-29T16:25:42Z")

</div>

We are our own certificate authority, and have our CA public certificate on the device so that all server certificates we sign with our CA private key are trusted by the devices so we can rotate server certificates freely.