How to update/renew a profile certificate via the APIs?

[deiv061]

Hi,
I’m working with profile creation and most of the parameters stay the same, but the certificate used in the profile has expired and now needs to be renewed.

Before I proceed, I’d like to clarify a few things:

1. Is it possible to update or renew the certificate in an existing profile using the available APIs?
2. If yes, what is the recommended way to replace only the certificate while keeping the rest of the profile parameters unchanged?
3. After I originally created the profile and accepted the confirmation window/permissions, can I create a new profile with the updated certificate without triggering the permission prompt again?
   (Or does the app always require the user confirmation dialog for each new profile/certificate?)

Any guidance or examples would be greatly appreciated.
Thanks!

[schwabe]

There is no real API to replace only the certificate in a profile. Typcially, users/admins will replace the whole profile. Replacing only the certificate is typically only done by individuals that will then just use the edit profile functionality of the app.

If you talk about AIDL permission, then yes, these are remembered. (But can be revoked)

[deiv061]

Thanks!
Just to confirm: is it acceptable to use the API to create a new profile that contains the updated certificate, start/activate that new profile, set it as the default one, and then delete the old profile afterward?

Would that be the recommended approach?

[schwabe]

I don't really know what your overall use case and what your users are. So I don't know if that is acceptable for your users or not. Some of the settings like allowed apps will get lost this way.

[deiv061]

We already have a working VPN deployment where each device gets exactly one profile. The only reason we need to update the profile now is because the certificate embedded in the existing .ovpn file is about to expire.

From a user‑experience point of view, we’d like to avoid showing the initial “verification/confirmation” window again when installing the updated profile — since nothing is changing for the user except the new certificate. We’re basically trying to provide a seamless update of the profile without making the user go through the first‑time verification prompt again.