An operator has been asked to replace current SSL/TLS certificate for VS(s). Will this operation be disruptive?

Question

Options

• ANo, the Virtual Services will continue without any disruption.
• BYes, to a degree. The Virtual Services will continue, but current connections will be disrupted.
• CYes, the Virtual Service will be disrupted since the Service Engine(s) need(s) to restart.
• DYes, for a very limited amount of time. A disruption will occur while the controller is pushing the

• A
  4% (2)
• B
  84% (47)
• C
  4% (2)
• D
  9% (5)

Explanation

Replacing an SSL/TLS certificate on a Virtual Service (VS) in Avi Networks/NSX ALB is a partial disruption: the VS stays up and accepts new connections immediately using the new certificate, but any existing SSL/TLS sessions established under the old certificate are torn down and must be re-negotiated - making B correct.

Why the distractors are wrong:

• A overstates resilience - ignoring that in-flight encrypted sessions tied to the old certificate handshake cannot simply continue; they must be reset.
• C is incorrect because Service Engines do not need to restart for a certificate swap; the controller pushes the new cert dynamically to the SE data plane.
• D is incomplete as written, but the implied idea - that disruption is only during the push - understates the impact; it's the active connections that break, not just a brief config-push window.

Memory tip: Think of it as swapping a lock mid-use - the door (VS) stays open for new visitors, but anyone already inside holding a key cut to the old lock gets kicked out and must re-enter with the new key.

No community discussion yet for this question.