**To rotate a VPN tunnel certificate** The following ``modify-vpn-tunnel-certificate`` example rotates the certificate for the specified tunnel for a VPN connection :: aws ec2 modify-vpn-tunnel-certificate \ --vpn-tunnel-outside-ip-address 203.0.113.17 \ --vpn-connection-id vpn-12345678901234567 Output:: { "VpnConnection": { "CustomerGatewayConfiguration": ...configuration information..., "CustomerGatewayId": "cgw-aabbccddee1122334", "Category": "VPN", "State": "modifying", "Type": "ipsec.1", "VpnConnectionId": "vpn-12345678901234567", "VpnGatewayId": "vgw-11223344556677889", "Options": { "StaticRoutesOnly": false }, "VgwTelemetry": [ { "AcceptedRouteCount": 0, "LastStatusChange": "2019-09-11T17:27:14.000Z", "OutsideIpAddress": "203.0.113.17", "Status": "DOWN", "StatusMessage": "IPSEC IS DOWN", "CertificateArn": "arn:aws:acm:us-east-1:123456789101:certificate/c544d8ce-20b8-4fff-98b0-example" }, { "AcceptedRouteCount": 0, "LastStatusChange": "2019-09-11T17:26:47.000Z", "OutsideIpAddress": "203.0.114.18", "Status": "DOWN", "StatusMessage": "IPSEC IS DOWN", "CertificateArn": "arn:aws:acm:us-east-1:123456789101:certificate/5ab64566-761b-4ad3-b259-example" } ] } }