What is the role of TLS certificates in SD-WAN device authentication, and what should be checked during renewal?

• A. Certificates authenticate devices to vSmart/vBond/vManage; renewal should verify CA trust, expiration, revocation status, correct hostnames, and chain integrity.
• B. Certificates are optional; renewal is not required.
• C. Renewal only needs to check the device's private key length.
• D. Renewal checks DNS A records only.

Answer: (A)

TLS certificates provide identity and trust in SD-WAN by letting devices authenticate to the controllers (vSmart, vBond, and vManage) during TLS handshakes. The certificate binds the device’s identity to its cryptographic keys, allowing the control-plane components to verify who is communicating and to protect the session from tampering.

During renewal, you should verify that the new certificate and its chain are trusted by the controllers: the CA trust is intact, the certificate is not expired, revocation status is current (via CRL or OCSP), and the chain is complete with the correct intermediate and root certificates so chain validation succeeds. The certificate’s subject or SAN must match the device’s identity used in the SD-WAN control plane (the hostname/IP seen by vSmart/vBond/vManage). Also ensure the private key remains secure and that the renewed certificate properly corresponds to the device’s public key.

Certificates aren’t optional in this setup, and renewal isn’t merely about key length. Focusing only on the private key length or on DNS A records ignores the essential aspects of trust, validity, revocation, and correct identity binding that TLS relies on for secure device authentication.