diff --git a/src/components/standalone/openvpn_rw/RWAccountsManager.vue b/src/components/standalone/openvpn_rw/RWAccountsManager.vue
index 340bdcc3b..25318bda6 100644
--- a/src/components/standalone/openvpn_rw/RWAccountsManager.vue
+++ b/src/components/standalone/openvpn_rw/RWAccountsManager.vue
@@ -279,7 +279,7 @@ function clearFilters() {
   <NeSkeleton v-if="isLoading" :lines="8" />
   <template v-else-if="users.length == 0">
     <NeEmptyState :title="t('standalone.openvpn_rw.no_users_found')" :icon="['fas', 'user-group']">
-      <NeButton kind="secondary" @click="openCreateEditDrawer()">
+      <NeButton kind="primary" @click="openCreateEditDrawer()">
         <template #prefix>
           <font-awesome-icon :icon="['fas', 'circle-plus']" class="h-4 w-4" aria-hidden="true" />
         </template>
@@ -330,7 +330,7 @@ function clearFilters() {
           </template>
           {{ t('standalone.openvpn_rw.download_all_configs') }}
         </NeButton>
-        <NeButton kind="secondary" @click="openCreateEditDrawer()">
+        <NeButton kind="primary" @click="openCreateEditDrawer()">
           <template #prefix>
             <font-awesome-icon :icon="['fas', 'circle-plus']" class="h-4 w-4" aria-hidden="true" />
           </template>
diff --git a/src/components/standalone/openvpn_rw/RWAccountsTable.vue b/src/components/standalone/openvpn_rw/RWAccountsTable.vue
index 131049573..cc810af60 100644
--- a/src/components/standalone/openvpn_rw/RWAccountsTable.vue
+++ b/src/components/standalone/openvpn_rw/RWAccountsTable.vue
@@ -16,13 +16,17 @@ import {
   NeTableRow,
   NeTableCell,
   NePaginator,
-  useItemPagination
+  useItemPagination,
+  NeSortDropdown,
+  type SortEvent,
+  NeBadge,
+  NeAvatar
 } from '@nethesis/vue-components'
 import type {
   RWAuthenticationMode,
   RWAccount
 } from '@/views/standalone/vpn/OpenvpnRoadWarriorView.vue'
-import { ref } from 'vue'
+import { ref, computed } from 'vue'
 import {
   faArrowsRotate,
   faCircleArrowDown,
@@ -30,7 +34,10 @@ import {
   faCircleXmark,
   faCircleInfo,
   faTrash,
-  faPenToSquare
+  faPenToSquare,
+  faXmark,
+  faTriangleExclamation,
+  faCircleExclamation
 } from '@fortawesome/free-solid-svg-icons'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
 
@@ -51,8 +58,54 @@ const emit = defineEmits<{
   regenerateCertificate: [item: RWAccount]
 }>()
 
+const sortKey = ref<'name' | 'connected'>('connected')
+const sortDescending = ref(false)
+
+const usersData = computed(() => props.users)
+
+// custom sorted items that keeps disabled items always at the end when sorting by connection status
+const sortedItems = computed(() => {
+  const items = [...usersData.value]
+
+  if (sortKey.value === 'connected') {
+    // separate enabled and disabled items
+    const enabledItems = items.filter((item) => item.openvpn_enabled !== '0')
+    const disabledItems = items.filter((item) => item.openvpn_enabled === '0')
+
+    // check if all enabled items have the same connection status
+    const allConnected = enabledItems.every((item) => item.connected === true)
+    const allNotConnected = enabledItems.every((item) => item.connected === false)
+    const allSameStatus = allConnected || allNotConnected
+
+    // only sort if items have different connection statuses
+    if (!allSameStatus) {
+      enabledItems.sort((a, b) => {
+        const aConnected = a.connected ? 1 : 0
+        const bConnected = b.connected ? 1 : 0
+        return bConnected - aConnected
+      })
+
+      // apply descending if needed
+      if (sortDescending.value) {
+        enabledItems.reverse()
+      }
+    }
+
+    return [...enabledItems, ...disabledItems]
+  } else {
+    // for 'name' sorting, use standard sort
+    items.sort((a, b) => a.name.localeCompare(b.name))
+
+    if (sortDescending.value) {
+      items.reverse()
+    }
+
+    return items
+  }
+})
+
 const pageSize = ref(10)
-const { currentPage, paginatedItems } = useItemPagination(() => props.users, {
+const { currentPage, paginatedItems } = useItemPagination(() => sortedItems.value, {
   itemsPerPage: pageSize
 })
 
@@ -121,21 +174,59 @@ function getDropdownItems(item: RWAccount) {
 function getCellClasses(item: RWAccount) {
   return item.openvpn_enabled === '0' ? ['opacity-50'] : []
 }
+
+const onSort = (payload: SortEvent) => {
+  sortKey.value = payload.key as 'name' | 'connected'
+  sortDescending.value = payload.descending
+}
+
+// certificates expiration warning
+const CERT_EXPIRY_WARNING_DAYS = 30
+
+function getDaysUntilExpiry(expiryTimestamp: number): number {
+  const secondsUntilExpiry = expiryTimestamp - Date.now() / 1000
+  return Math.floor(secondsUntilExpiry / 86400)
+}
+
+function isCertificateExpiringSoon(expiryTimestamp: number): boolean {
+  const daysUntilExpiry = getDaysUntilExpiry(expiryTimestamp)
+  return daysUntilExpiry < CERT_EXPIRY_WARNING_DAYS && daysUntilExpiry >= 0
+}
 </script>
 
 <template>
-  <NeTable :aria-label="t('standalone.openvpn_rw.roadwarrior_accounts')" card-breakpoint="xl">
+  <NeSortDropdown
+    v-model:sort-key="sortKey"
+    v-model:sort-descending="sortDescending"
+    :label="t('sort.sort')"
+    :options="[
+      { id: 'connected', label: t('standalone.openvpn_rw.connection') },
+      { id: 'name', label: t('standalone.openvpn_rw.user') }
+    ]"
+    :open-menu-aria-label="t('ne_dropdown.open_menu')"
+    :sort-by-label="t('sort.sort_by')"
+    :sort-direction-label="t('sort.direction')"
+    :ascending-label="t('sort.ascending')"
+    :descending-label="t('sort.descending')"
+    class="lg:hidden"
+  />
+  <NeTable
+    :sort-key="sortKey"
+    :sort-descending="sortDescending"
+    :aria-label="t('standalone.openvpn_rw.roadwarrior_accounts')"
+    card-breakpoint="xl"
+  >
     <NeTableHead>
-      <NeTableHeadCell>
-        {{ t('standalone.openvpn_rw.username') }}
+      <NeTableHeadCell sortable column-key="name" @sort="onSort">
+        {{ t('standalone.openvpn_rw.user') }}
       </NeTableHeadCell>
       <NeTableHeadCell>
-        {{ t('standalone.openvpn_rw.expiration') }}
+        {{ t('standalone.openvpn_rw.certificate_expiration') }}
       </NeTableHeadCell>
       <NeTableHeadCell>
         {{ t('standalone.openvpn_rw.reserved_ip') }}
       </NeTableHeadCell>
-      <NeTableHeadCell>
+      <NeTableHeadCell sortable column-key="connected" @sort="onSort">
         {{ t('standalone.openvpn_rw.connection') }}
       </NeTableHeadCell>
       <NeTableHeadCell>
@@ -144,105 +235,121 @@ function getCellClasses(item: RWAccount) {
     </NeTableHead>
     <NeTableBody>
       <NeTableRow v-for="item in paginatedItems" :key="item.id">
-        <!-- username -->
-        <NeTableCell :data-label="t('standalone.openvpn_rw.username')">
-          <div class="flex flex-row gap-x-3">
-            <p :class="[getCellClasses(item)]">
-              {{ item.name }}
-            </p>
-            <!-- password not configured warning -->
-            <NeTooltip
-              v-if="
-                item.local &&
-                !item.password &&
-                (authenticationMode === 'username_password' ||
-                  authenticationMode === 'username_password_certificate')
-              "
-              interactive
-            >
-              <template #trigger>
-                <font-awesome-icon
-                  :icon="['fas', 'triangle-exclamation']"
-                  class="h-4 w-4 text-amber-500"
-                />
-              </template>
-              <template #content>
-                <div class="text-center">
-                  <p>{{ t('standalone.openvpn_rw.password_not_configured') }}</p>
-                  <router-link
-                    class="text-primary-500 dark:text-primary-800"
-                    to="/standalone/users-objects/users-database"
-                    >{{ t('standalone.openvpn_rw.edit_user_database') }}</router-link
-                  >
-                </div>
-              </template>
-            </NeTooltip>
-            <NeTooltip v-if="item.valid === false">
+        <!-- user -->
+        <NeTableCell :data-label="t('standalone.openvpn_rw.user')">
+          <div class="space-y-2">
+            <div class="flex flex-wrap items-center gap-2">
+              <NeAvatar :squared="false" alt="Avatar" size="sm" />
+              <div>
+                <p v-if="item.description" :class="[getCellClasses(item)]">
+                  {{ item.description }}
+                </p>
+                <p :class="[getCellClasses(item)]">
+                  {{ item.name }}
+                </p>
+              </div>
+              <div class="flex items-center gap-2 self-start">
+                <NeTooltip
+                  v-if="
+                    item.local &&
+                    !item.password &&
+                    (authenticationMode === 'username_password' ||
+                      authenticationMode === 'username_password_certificate')
+                  "
+                  interactive
+                >
+                  <template #trigger>
+                    <FontAwesomeIcon :icon="faTriangleExclamation" class="h-4 w-4 text-amber-500" />
+                  </template>
+                  <template #content>
+                    <div class="text-center">
+                      <p>{{ t('standalone.openvpn_rw.password_not_configured') }}</p>
+                      <RouterLink
+                        class="text-primary-500 dark:text-primary-800"
+                        to="/standalone/users-objects/users-database"
+                      >
+                        {{ t('standalone.openvpn_rw.edit_user_database') }}
+                      </RouterLink>
+                    </div>
+                  </template>
+                </NeTooltip>
+                <NeTooltip v-if="item.valid === false">
+                  <template #trigger>
+                    <FontAwesomeIcon
+                      :icon="faCircleInfo"
+                      class="h-4 w-4 text-indigo-500 dark:text-indigo-300"
+                    />
+                  </template>
+                  <template #content>
+                    <div class="text-center">
+                      <p>{{ t('standalone.openvpn_rw.user_not_valid') }}</p>
+                    </div>
+                  </template>
+                </NeTooltip>
+              </div>
+              <NeBadge
+                v-if="item.openvpn_enabled === '0'"
+                :icon="faXmark"
+                :text="t('common.disabled')"
+                kind="secondary"
+              />
+            </div>
+            <NeTooltip v-if="item.connected" interactive placement="bottom">
               <template #trigger>
-                <FontAwesomeIcon
-                  :icon="faCircleInfo"
-                  class="h-4 w-4 text-indigo-500 dark:text-indigo-300"
-                />
+                <NeButton class="ml-8" kind="tertiary" size="sm">
+                  {{ t('standalone.openvpn_rw.more_info') }}
+                </NeButton>
               </template>
               <template #content>
-                <div class="text-center">
-                  <p>{{ t('standalone.openvpn_rw.user_not_valid') }}</p>
+                <div>
+                  <div class="px-2 py-1">
+                    <div class="py-1">
+                      <span class="mr-2 inline-block font-semibold">
+                        {{ t('standalone.openvpn_rw.virtual_ip') }}:
+                      </span>
+                      <span class="text-gray-300 dark:text-gray-500"
+                        >{{ item.virtual_address }}
+                      </span>
+                    </div>
+                    <div class="py-1">
+                      <span class="mr-2 inline-block font-semibold">
+                        {{ t('standalone.openvpn_rw.remote_ip') }}:
+                      </span>
+                      <span class="text-gray-300 dark:text-gray-500">{{ item.real_address }}</span>
+                    </div>
+                    <div class="py-1">
+                      <span class="mr-2 inline-block font-semibold">
+                        {{ t('standalone.openvpn_rw.started') }}:
+                      </span>
+                      <span class="text-gray-300 dark:text-gray-500">
+                        {{
+                          `${new Date((item.since as number) * 1000).toLocaleDateString()} ${new Date(
+                            (item.since as number) * 1000
+                          ).toLocaleTimeString()}`
+                        }}
+                      </span>
+                    </div>
+                    <div class="py-1 align-top">
+                      <span class="mr-2 inline-block align-top font-semibold">
+                        {{ t('standalone.openvpn_rw.traffic') }}:
+                      </span>
+                      <span class="inline-block align-top text-gray-300 dark:text-gray-500">
+                        {{ parseInt(item.bytes_sent as string) / 1000 }} KB
+                        {{ t('standalone.openvpn_rw.sent') }}<br />{{
+                          parseInt(item.bytes_received as string) / 1000
+                        }}
+                        KB {{ t('standalone.openvpn_rw.received') }}
+                      </span>
+                    </div>
+                  </div>
                 </div>
               </template>
             </NeTooltip>
           </div>
-          <!-- more info button -->
-          <NeTooltip v-if="item.connected" interactive placement="bottom">
-            <template #trigger>
-              <NeButton size="sm" kind="tertiary" class="-mx-2">{{
-                t('standalone.openvpn_rw.more_info')
-              }}</NeButton>
-            </template>
-            <template #content>
-              <div>
-                <div class="px-2 py-1">
-                  <div class="py-1">
-                    <span class="mr-2 inline-block font-semibold"
-                      >{{ t('standalone.openvpn_rw.virtual_ip') }}:</span
-                    >
-                    <span class="text-gray-300 dark:text-gray-500">{{ item.virtual_address }}</span>
-                  </div>
-                  <div class="py-1">
-                    <span class="mr-2 inline-block font-semibold"
-                      >{{ t('standalone.openvpn_rw.remote_ip') }}:</span
-                    >
-                    <span class="text-gray-300 dark:text-gray-500">{{ item.real_address }}</span>
-                  </div>
-                  <div class="py-1">
-                    <span class="mr-2 inline-block font-semibold"
-                      >{{ t('standalone.openvpn_rw.started') }}:</span
-                    >
-                    <span class="text-gray-300 dark:text-gray-500">{{
-                      `${new Date((item.since as number) * 1000).toLocaleDateString()} ${new Date(
-                        (item.since as number) * 1000
-                      ).toLocaleTimeString()}`
-                    }}</span>
-                  </div>
-                  <div class="py-1 align-top">
-                    <span class="mr-2 inline-block align-top font-semibold"
-                      >{{ t('standalone.openvpn_rw.traffic') }}:</span
-                    >
-                    <span class="inline-block align-top text-gray-300 dark:text-gray-500"
-                      >{{ parseInt(item.bytes_sent as string) / 1000 }} KB
-                      {{ t('standalone.openvpn_rw.sent') }}<br />{{
-                        parseInt(item.bytes_received as string) / 1000
-                      }}
-                      KB {{ t('standalone.openvpn_rw.received') }}</span
-                    >
-                  </div>
-                </div>
-              </div>
-            </template>
-          </NeTooltip>
         </NeTableCell>
         <!-- expiration -->
         <NeTableCell :data-label="t('standalone.openvpn_rw.expiration')">
-          <div class="flex flex-row gap-x-3">
+          <div class="flex items-start gap-3">
             <p :class="[getCellClasses(item)]">
               {{
                 item.expiration
@@ -250,17 +357,43 @@ function getCellClasses(item: RWAccount) {
                   : '-'
               }}
             </p>
+            <!-- certificate expiring soon warning -->
+            <NeTooltip
+              v-if="item.expiration && isCertificateExpiringSoon(Number(item.expiration))"
+              class
+              interactive
+            >
+              <template #trigger>
+                <FontAwesomeIcon
+                  :icon="faTriangleExclamation"
+                  class="size-4 text-amber-700 dark:text-amber-500"
+                  aria-hidden="true"
+                />
+              </template>
+              <template #content>
+                <div class="text-center">
+                  <p>
+                    {{
+                      t('standalone.openvpn_rw.certificate_expiring_tooltip', {
+                        days: getDaysUntilExpiry(Number(item.expiration))
+                      })
+                    }}
+                  </p>
+                </div>
+              </template>
+            </NeTooltip>
             <!-- certificate expired warning -->
             <NeTooltip v-if="item.expired" interactive>
               <template #trigger>
-                <font-awesome-icon
-                  :icon="['fas', 'triangle-exclamation']"
-                  class="h-4 w-4 text-amber-500"
+                <FontAwesomeIcon
+                  :icon="faCircleExclamation"
+                  class="h-4 w-4 text-red-700 dark:text-red-500"
+                  aria-hidden="true"
                 />
               </template>
               <template #content>
-                <div class="text-center">
-                  <p>{{ t('standalone.openvpn_rw.this_certificate_expired') }}</p>
+                <div class="text-left">
+                  <p>{{ t('standalone.openvpn_rw.certificate_expired_tooltip') }}</p>
                   <p
                     class="cursor-pointer text-primary-500 dark:text-primary-800"
                     @click="emit('regenerateCertificate', item)"
@@ -280,17 +413,24 @@ function getCellClasses(item: RWAccount) {
         </NeTableCell>
         <!-- connection -->
         <NeTableCell :data-label="t('standalone.openvpn_rw.connection')">
-          <div v-if="item.valid === false" class="flex flex-row items-center">
+          <div
+            v-if="item.valid === false || item.openvpn_enabled === '0'"
+            :class="['flex', 'flex-row', 'items-center', ...getCellClasses(item)]"
+          >
             <p>-</p>
           </div>
           <div v-else :class="['flex', 'flex-row', 'items-center', getCellClasses(item)]">
-            <font-awesome-icon
-              :icon="['fas', item.connected ? 'circle-check' : 'circle-xmark']"
+            <FontAwesomeIcon
+              :icon="item.connected ? faCircleCheck : faCircleXmark"
               :class="[
                 'mr-2',
                 'h-5',
                 'w-5',
-                item.connected ? 'text-green-600 dark:text-green-400' : ''
+                item.openvpn_enabled === '1'
+                  ? item.connected
+                    ? 'text-green-700 dark:text-green-500'
+                    : 'text-red-700 dark:text-red-500'
+                  : ''
               ]"
               aria-hidden="true"
             />
diff --git a/src/components/standalone/openvpn_rw/RWServerDetails.vue b/src/components/standalone/openvpn_rw/RWServerDetails.vue
index 336520ec9..ff0223180 100644
--- a/src/components/standalone/openvpn_rw/RWServerDetails.vue
+++ b/src/components/standalone/openvpn_rw/RWServerDetails.vue
@@ -1,24 +1,56 @@
 <!--
-  Copyright (C) 2024 Nethesis S.r.l.
+  Copyright (C) 2026 Nethesis S.r.l.
   SPDX-License-Identifier: GPL-3.0-or-later
 -->
 
 <script setup lang="ts">
 import { useI18n } from 'vue-i18n'
-import { NeDropdown } from '@nethesis/vue-components'
-import { NeButton } from '@nethesis/vue-components'
+import { NeDropdown, NeTooltip } from '@nethesis/vue-components'
 import type { RWServer } from '@/views/standalone/vpn/OpenvpnRoadWarriorView.vue'
-import { faServer, faTrash, faUserGroup } from '@fortawesome/free-solid-svg-icons'
+import {
+  faPenToSquare,
+  faServer,
+  faTrash,
+  faUserGroup,
+  faTriangleExclamation,
+  faCircleExclamation,
+  faArrowRotateRight,
+  faRefresh,
+  faCircleCheck,
+  faCircleXmark
+} from '@fortawesome/free-solid-svg-icons'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
 
-const { t } = useI18n()
+const { t, locale } = useI18n()
 
 defineProps<{
   server: RWServer
   connectedClients: number
 }>()
 
-const emit = defineEmits(['delete-server', 'edit-server'])
+const emit = defineEmits([
+  'delete-server',
+  'edit-server',
+  'renew-server-certificate',
+  'regenerate-all-certificates'
+])
+
+// certificates expiration warning
+const CERT_EXPIRY_WARNING_DAYS = 30
+
+function getDaysUntilExpiry(expiryTimestamp: number): number {
+  const secondsUntilExpiry = expiryTimestamp - Date.now() / 1000
+  return Math.floor(secondsUntilExpiry / 86400)
+}
+
+function isCertificateExpiringSoon(expiryTimestamp: number): boolean {
+  const daysUntilExpiry = getDaysUntilExpiry(expiryTimestamp)
+  return daysUntilExpiry < CERT_EXPIRY_WARNING_DAYS && daysUntilExpiry >= 0
+}
+
+function isCertificatesExpired(expiryTimestamp: number): boolean {
+  return expiryTimestamp <= Date.now() / 1000
+}
 </script>
 
 <template>
@@ -35,17 +67,19 @@ const emit = defineEmits(['delete-server', 'edit-server'])
       <div
         class="mr-10 ml-4 grow border-l border-gray-800 py-3 pl-4 text-sm md:ml-8 md:pl-8 dark:border-gray-600"
       >
-        <div class="flex max-w-xl flex-col justify-between gap-y-4 sm:flex-row sm:gap-x-4">
+        <div class="grid grid-cols-1 items-center gap-x-6 gap-y-6 sm:grid-cols-2 xl:grid-cols-4">
           <div>
             <p class="mb-2 font-semibold">{{ t('standalone.openvpn_rw.status') }}</p>
             <div :class="['flex', 'flex-row', 'items-center']">
-              <font-awesome-icon
-                :icon="['fas', server.enabled == '1' ? 'circle-check' : 'circle-xmark']"
+              <FontAwesomeIcon
+                :icon="server.enabled == '1' ? faCircleCheck : faCircleXmark"
                 :class="[
                   'mr-2',
                   'h-4',
                   'w-4',
-                  server.enabled == '1' ? 'text-green-500' : 'text-rose-500'
+                  server.enabled == '1'
+                    ? 'text-green-700 dark:text-green-500'
+                    : 'text-red-700 dark:text-red-500'
                 ]"
                 aria-hidden="true"
               />
@@ -54,10 +88,6 @@ const emit = defineEmits(['delete-server', 'edit-server'])
               </p>
             </div>
           </div>
-          <div>
-            <p class="mb-2 font-semibold">{{ t('standalone.openvpn_rw.authentication_mode') }}</p>
-            <p>{{ t(`standalone.openvpn_rw.${server.ns_auth_mode}`) }}</p>
-          </div>
           <div>
             <p class="mb-2 font-semibold">{{ t('standalone.openvpn_rw.database') }}</p>
             <p>
@@ -68,21 +98,155 @@ const emit = defineEmits(['delete-server', 'edit-server'])
               }}
             </p>
           </div>
+          <div>
+            <p class="mb-2 font-semibold">{{ t('standalone.openvpn_rw.authentication_mode') }}</p>
+            <p>{{ t(`standalone.openvpn_rw.${server.ns_auth_mode}`) }}</p>
+          </div>
+          <div>
+            <p class="mb-2 font-semibold">
+              {{ t('standalone.openvpn_rw.certificates_expiration') }}
+            </p>
+            <!-- Server certificate row -->
+            <div class="mb-2 flex flex-row items-center gap-x-2">
+              <p>
+                {{ t('standalone.openvpn_rw.server') }}
+                {{
+                  server.certificates.server
+                    ? new Date(server.certificates.server * 1000).toLocaleString(locale)
+                    : '-'
+                }}
+              </p>
+              <!-- certificate expiring soon warning -->
+              <NeTooltip
+                v-if="
+                  server.certificates.server &&
+                  isCertificateExpiringSoon(server.certificates.server)
+                "
+                interactive
+              >
+                <template #trigger>
+                  <FontAwesomeIcon
+                    :icon="faTriangleExclamation"
+                    class="h-4 w-4 text-amber-700 dark:text-amber-500"
+                    aria-hidden="true"
+                  />
+                </template>
+                <template #content>
+                  <div class="text-center">
+                    <p>
+                      {{
+                        t('standalone.openvpn_rw.certificate_expiring_tooltip', {
+                          days: getDaysUntilExpiry(server.certificates.server)
+                        })
+                      }}
+                    </p>
+                  </div>
+                </template>
+              </NeTooltip>
+              <!-- certificate expired warning -->
+              <NeTooltip
+                v-if="
+                  server.certificates.server && isCertificatesExpired(server.certificates.server)
+                "
+                interactive
+              >
+                <template #trigger>
+                  <FontAwesomeIcon
+                    :icon="faCircleExclamation"
+                    class="h-4 w-4 text-red-700 dark:text-red-500"
+                    aria-hidden="true"
+                  />
+                </template>
+                <template #content>
+                  <div class="text-center">
+                    <p>{{ t('standalone.openvpn_rw.certificate_expired_tooltip') }}</p>
+                  </div>
+                </template>
+              </NeTooltip>
+            </div>
+            <!-- CA certificate row -->
+            <div class="flex flex-row items-center gap-x-2">
+              <p>
+                {{ t('standalone.openvpn_rw.ca') }}
+                {{
+                  server.certificates.CA
+                    ? new Date(server.certificates.CA * 1000).toLocaleString(locale)
+                    : '-'
+                }}
+              </p>
+              <!-- certificate expiring soon warning -->
+              <NeTooltip
+                v-if="server.certificates.CA && isCertificateExpiringSoon(server.certificates.CA)"
+                interactive
+              >
+                <template #trigger>
+                  <FontAwesomeIcon
+                    :icon="faTriangleExclamation"
+                    class="h-4 w-4 text-amber-700 dark:text-amber-500"
+                    aria-hidden="true"
+                  />
+                </template>
+                <template #content>
+                  <div class="text-center">
+                    <p>
+                      {{
+                        t('standalone.openvpn_rw.certificate_expiring_tooltip', {
+                          days: getDaysUntilExpiry(server.certificates.CA)
+                        })
+                      }}
+                    </p>
+                  </div>
+                </template>
+              </NeTooltip>
+              <!-- certificate expired warning -->
+              <NeTooltip
+                v-if="server.certificates.CA && isCertificatesExpired(server.certificates.CA)"
+                interactive
+              >
+                <template #trigger>
+                  <FontAwesomeIcon
+                    :icon="faCircleExclamation"
+                    class="h-4 w-4 text-red-700 dark:text-red-500"
+                    aria-hidden="true"
+                  />
+                </template>
+                <template #content>
+                  <div class="text-center">
+                    <p>{{ t('standalone.openvpn_rw.certificate_expired_tooltip') }}</p>
+                  </div>
+                </template>
+              </NeTooltip>
+            </div>
+          </div>
         </div>
       </div>
       <div class="flex flex-row items-center">
-        <NeButton kind="tertiary" class="mr-2" @click="emit('edit-server')">
-          <template #prefix>
-            <font-awesome-icon
-              :icon="['fas', 'pen-to-square']"
-              class="h-4 w-4"
-              aria-hidden="true"
-            />
-          </template>
-          {{ t('common.edit') }}
-        </NeButton>
         <NeDropdown
           :items="[
+            {
+              id: 'edit',
+              label: t('standalone.openvpn_rw.edit_server'),
+              icon: faPenToSquare,
+              action: () => {
+                emit('edit-server')
+              }
+            },
+            {
+              id: 'renew_server_certificate',
+              label: t('standalone.openvpn_rw.renew_server_certificate'),
+              icon: faArrowRotateRight,
+              action: () => {
+                emit('renew-server-certificate')
+              }
+            },
+            {
+              id: 'regenerate_all_certificates',
+              label: t('standalone.openvpn_rw.regenerate_all_certificates'),
+              icon: faRefresh,
+              action: () => {
+                emit('regenerate-all-certificates')
+              }
+            },
             {
               id: 'delete',
               label: t('common.delete'),
diff --git a/src/components/standalone/openvpn_rw/RegenerateRWAllCertificatesModal.vue b/src/components/standalone/openvpn_rw/RegenerateRWAllCertificatesModal.vue
new file mode 100644
index 000000000..321b5ec73
--- /dev/null
+++ b/src/components/standalone/openvpn_rw/RegenerateRWAllCertificatesModal.vue
@@ -0,0 +1,83 @@
+<!--
+  Copyright (C) 2026 Nethesis S.r.l.
+  SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+<script setup lang="ts">
+import { ubusCall } from '@/lib/standalone/ubus'
+import { ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { getAxiosErrorMessage, NeTextInput } from '@nethesis/vue-components'
+import { NeModal, NeInlineNotification } from '@nethesis/vue-components'
+
+const props = defineProps<{
+  visible: boolean
+  instanceName?: string
+  serverName?: string
+}>()
+
+const emit = defineEmits(['close', 'all-certificates-regenerated'])
+
+const { t } = useI18n()
+
+const error = ref<Error>()
+const serverNameModal = ref('')
+const isRegenerating = ref(false)
+
+async function regenerateAllCertificates() {
+  if (props.instanceName) {
+    try {
+      error.value = undefined
+      isRegenerating.value = true
+      await ubusCall('ns.ovpnrw', 'regenerate-all-certificates', {
+        instance: props.instanceName
+      })
+      emit('all-certificates-regenerated')
+      emit('close')
+    } catch (err: any) {
+      error.value = err
+    } finally {
+      isRegenerating.value = false
+    }
+  }
+}
+
+function close() {
+  if (!isRegenerating.value) {
+    error.value = undefined
+    serverNameModal.value = ''
+    emit('close')
+  }
+}
+</script>
+
+<template>
+  <NeModal
+    :visible="visible"
+    kind="warning"
+    :title="t('standalone.openvpn_rw.regenerate_all_certificates')"
+    :primary-label="t('standalone.openvpn_rw.regenerate')"
+    :cancel-label="t('common.cancel')"
+    :primary-button-disabled="isRegenerating || props.serverName !== serverNameModal"
+    :primary-button-loading="isRegenerating"
+    primary-button-kind="danger"
+    :close-aria-label="t('common.close')"
+    @primary-click="regenerateAllCertificates()"
+    @close="close()"
+  >
+    <NeInlineNotification
+      v-if="error"
+      kind="error"
+      :title="t('error.cannot_renew_server_cert')"
+      :description="t(getAxiosErrorMessage(error))"
+      class="mb-2"
+    />
+    {{ t('standalone.openvpn_rw.regenerate_all_certificates_message') }}
+    <NeTextInput
+      v-model="serverNameModal"
+      class="mt-4"
+      :disabled="isRegenerating"
+      :label="t('standalone.openvpn_rw.type_server_name', { server: props.serverName })"
+    />
+  </NeModal>
+</template>
diff --git a/src/components/standalone/openvpn_rw/RenewRWServerCertificateModal.vue b/src/components/standalone/openvpn_rw/RenewRWServerCertificateModal.vue
new file mode 100644
index 000000000..1cd0ef88a
--- /dev/null
+++ b/src/components/standalone/openvpn_rw/RenewRWServerCertificateModal.vue
@@ -0,0 +1,74 @@
+<!--
+  Copyright (C) 2026 Nethesis S.r.l.
+  SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+<script setup lang="ts">
+import { ubusCall } from '@/lib/standalone/ubus'
+import { ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { getAxiosErrorMessage } from '@nethesis/vue-components'
+import { NeModal, NeInlineNotification } from '@nethesis/vue-components'
+
+const props = defineProps<{
+  visible: boolean
+  instanceName?: string
+}>()
+
+const emit = defineEmits(['close', 'server-certificate-renewed'])
+
+const { t } = useI18n()
+
+const error = ref<Error>()
+const isRenewing = ref(false)
+
+async function renewServerCertificate() {
+  if (props.instanceName) {
+    try {
+      error.value = undefined
+      isRenewing.value = true
+      await ubusCall('ns.ovpnrw', 'renew-server-certificate', {
+        instance: props.instanceName
+      })
+      emit('server-certificate-renewed')
+      emit('close')
+    } catch (err: any) {
+      error.value = err
+    } finally {
+      isRenewing.value = false
+    }
+  }
+}
+
+function close() {
+  if (!isRenewing.value) {
+    error.value = undefined
+    emit('close')
+  }
+}
+</script>
+
+<template>
+  <NeModal
+    :visible="visible"
+    kind="warning"
+    :title="t('standalone.openvpn_rw.renew_server_certificate')"
+    :primary-label="t('standalone.openvpn_rw.renew')"
+    :cancel-label="t('common.cancel')"
+    :primary-button-disabled="isRenewing"
+    :primary-button-loading="isRenewing"
+    primary-button-kind="primary"
+    :close-aria-label="t('common.close')"
+    @primary-click="renewServerCertificate()"
+    @close="close()"
+  >
+    <NeInlineNotification
+      v-if="error"
+      kind="error"
+      :title="t('error.cannot_renew_server_cert')"
+      :description="t(getAxiosErrorMessage(error))"
+      class="mb-2"
+    />
+    {{ t('standalone.openvpn_rw.renew_server_certificate_message') }}
+  </NeModal>
+</template>
diff --git a/src/i18n/en.json b/src/i18n/en.json
index a3f12a941..4ebbf8c11 100644
--- a/src/i18n/en.json
+++ b/src/i18n/en.json
@@ -427,7 +427,9 @@
     "cannot_reuse_old_password": "New password must be different from the old one",
     "duplicate_ip": "IP has already been used",
     "duplicate_port": "Port has already been used",
-    "cannot_regenerate_cert": "Cannot regenerate certificates"
+    "cannot_regenerate_cert": "Cannot regenerate certificates",
+    "cannot_renew_server_cert": "Cannot renew server certificate",
+    "cannot_regenerate_all_certs": "Cannot regenerate all certificates"
   },
   "ne_text_input": {
     "show_password": "Show password",
@@ -1914,7 +1916,7 @@
       "status": "Status",
       "connected_clients": "Connected clients",
       "roadwarrior_accounts": "Road Warrior accounts",
-      "roadwarrior_accounts_description": "Users in this list can connect to the OpenVPN Road Warrior server. Only users with a configured password can use the 'username and password' authentication mode. If the selected authentication mode requires an x509 certificate, the certificate must be valid. Changes to users take effect immediately.",
+      "roadwarrior_accounts_description": "Users in this list can connect to the OpenVPN Road Warrior server. Depending on the authentication mode, a password and/or a valid x509 certificate is required. Changes take effect immediately.",
       "username_password": "Username and password",
       "certificate": "Certificate",
       "username_password_certificate": "Username, password and certificate",
@@ -2003,7 +2005,23 @@
         "filter_accounts": "Filter accounts",
         "cannot_download_history": "Cannot download history",
         "cannot_fetch_history": "Cannot fetch history"
-      }
+      },
+      "certificates_expiration": "Certificates expiration",
+      "certificate_expiration": "Certificate expiration",
+      "certificate_expiring_tooltip": "The certificate will expire in {days} days",
+      "certificate_expired_tooltip": "The certificate is expired",
+      "renew_server_certificate": "Renew server certificate",
+      "regenerate_all_certificates": "Regenerate all certificates",
+      "renew_server_certificate_message": "This action will renew the server certificate using the existing Certification Authority (CA). Client configurations and certificates will remain valid.",
+      "regenerate_all_certificates_message": "This action will regenerate the Certification Authority (CA) and all server certificates. All existing certificates will become invalid and clients will need to download and install new configuration files.",
+      "server_certificate_renewed": "Server certificate renewed",
+      "server_certificate_renewed_message": "The server certificate has been successfully renewed.",
+      "all_certificates_regenerated": "Certificates regenerated",
+      "all_certificates_regenerated_message": "All certificates have been successfully regenerated.",
+      "type_server_name": "Type the server name '{server}' to confirm",
+      "regenerate": "Regenerate",
+      "server": "Server",
+      "ca": "CA"
     },
     "openvpn_tunnel": {
       "title": "OpenVPN tunnel",
diff --git a/src/i18n/it.json b/src/i18n/it.json
index 73d4d94f4..f7d138343 100644
--- a/src/i18n/it.json
+++ b/src/i18n/it.json
@@ -427,7 +427,9 @@
     "duplicate_ip": "L'IP è già stato utilizzato",
     "duplicate_port": "La porta è già stata utilizzata",
     "cannot_restart_ipsec": "Impossibile riavviare il servizio IPsec",
-    "cannot_regenerate_cert": "Impossibile rigenerare i certificati"
+    "cannot_regenerate_cert": "Impossibile rigenerare i certificati",
+    "cannot_renew_server_cert": "Impossibile rinnovare il certificato del server",
+    "cannot_regenerate_all_certs": "Impossibile rigenerare tutti i certificati"
   },
   "login": {
     "sign_in": "Accedi",
@@ -1812,7 +1814,7 @@
       "download_configuration": "Scarica configurazione",
       "password_not_configured": "Password non configurata",
       "reserved_ip": "IP riservato",
-      "roadwarrior_accounts_description": "Gli utenti in questa lista posso collegarsi al server OpenVPN Road Warrior. Solamente gli utenti che hanno configurato una password possono utilizzare la modalità di autenticazione 'utente e password'. Se la modalità di autenticazione selezionata richiede un certificato x509, il certificato deve essere valido. Le modifiche agli utenti hanno effetto immediato.",
+      "roadwarrior_accounts_description": "Gli utenti in questa lista possono collegarsi al server OpenVPN Road Warrior. A seconda della modalità di autenticazione, è richiesta una password e/o un certificato x509 valido. Le modifiche hanno effetto immediato.",
       "disable_account_message": "L'utente è attualmente collegato via VPN. Disabilitando questo utente, la sessione VPN corrente verrà terminata.",
       "create_accounts_for_all_users": "Crea un account per ogni utente",
       "no_openvpn_rw_server_found": "Nessun server OpenVPN Road Warrior trovato",
@@ -1863,7 +1865,23 @@
         "road_warrior_server": "Server Road Warrior",
         "connections_history": "Cronologia delle connessioni"
       },
-      "user_not_valid": "Utente non valido: l'utente ha una configurazione VPN ma non è presente all'interno del database utenti remoto."
+      "user_not_valid": "Utente non valido: l'utente ha una configurazione VPN ma non è presente all'interno del database utenti remoto.",
+      "certificates_expiration": "Scadenza certificati",
+      "certificate_expiration": "Scadenza certificato",
+      "certificate_expiring_tooltip": "Il certificato scadrà tra {days} giorni",
+      "certificate_expired_tooltip": "Il certificato è scaduto",
+      "renew_server_certificate": "Rinnova certificato server",
+      "regenerate_all_certificates": "Rigenera tutti i certificati",
+      "renew_server_certificate_message": "Questa azione rinnoverà il certificato del server utilizzando l'Autorità di Certificazione (CA) esistente. Le configurazioni e i certificati dei client rimarranno validi.",
+      "regenerate_all_certificates_message": "Questa azione rigenererà l'Autorità di Certificazione (CA) e tutti i certificati del server. Tutti i certificati esistenti diventeranno invalidi e i client dovranno scaricare e installare i nuovi file di configurazione.",
+      "server_certificate_renewed": "Certificato server rinnovato",
+      "server_certificate_renewed_message": "Il certificato del server è stato rinnovato con successo.",
+      "all_certificates_regenerated": "Certificati rigenerati",
+      "all_certificates_regenerated_message": "I certificati sono stati rigenerati con successo.",
+      "type_server_name": "Digita il nome del server '{server}' per confermare",
+      "regenerate": "Rigenera",
+      "server": "Server",
+      "ca": "CA"
     },
     "qos": {
       "interface": "Interfaccia",
diff --git a/src/views/standalone/vpn/OpenvpnRoadWarriorView.vue b/src/views/standalone/vpn/OpenvpnRoadWarriorView.vue
index ca5619102..bde72beea 100644
--- a/src/views/standalone/vpn/OpenvpnRoadWarriorView.vue
+++ b/src/views/standalone/vpn/OpenvpnRoadWarriorView.vue
@@ -24,7 +24,11 @@ import { useUciPendingChangesStore } from '@/stores/standalone/uciPendingChanges
 import { computed } from 'vue'
 import DeleteRWServerModal from '@/components/standalone/openvpn_rw/DeleteRWServerModal.vue'
 import CreateOrEditRWServerDrawer from '@/components/standalone/openvpn_rw/CreateOrEditRWServerDrawer.vue'
+import RenewRWServerCertificateModal from '@/components/standalone/openvpn_rw/RenewRWServerCertificateModal.vue'
+import RegenerateRWAllCertificatesModal from '@/components/standalone/openvpn_rw/RegenerateRWAllCertificatesModal.vue'
+
 import ConnectionsHistory from '@/components/standalone/openvpn_rw/ConnectionsHistory.vue'
+import { useNotificationsStore } from '@/stores/notifications'
 
 export type RWAuthenticationMode =
   | 'username_password'
@@ -55,6 +59,10 @@ export type RWServer = {
   compress?: string
   ns_description: string
   ifconfig_pool?: string[]
+  certificates: {
+    CA?: number
+    server?: number
+  }
 }
 
 export type RWAccount = {
@@ -88,6 +96,7 @@ const RELOAD_INTERVAL = 10000
 const loading = ref(true)
 const loadingUsers = ref(true)
 const instanceName = ref('')
+const serverName = ref('')
 const instanceData = ref<RWServer>()
 const users = ref<RWAccount[]>([])
 const error = ref({
@@ -95,12 +104,15 @@ const error = ref({
   notificationDescription: '',
   notificationDetails: ''
 })
+const notificationsStore = useNotificationsStore()
 
 const isInitializingInstance = ref(false)
 const showDeleteServerModal = ref(false)
 const showCreateOrEditServerModal = ref(false)
 const loadingError = ref(false)
 const fetchServerIntervalId = ref(0)
+const showRenewServerCertificateModal = ref(false)
+const showRegenerateAllCertificatesModal = ref(false)
 
 const connectedClients = computed(() => users.value.filter((x) => x.connected).length)
 
@@ -147,6 +159,7 @@ async function fetchServer(setLoading: boolean = true) {
         await ubusCall('ns.ovpnrw', 'get-configuration', { instance: instanceName.value })
       ).data
       if (instanceData.value?.ns_description) {
+        serverName.value = instanceData.value.ns_description
         await fetchUsers(setLoading)
       }
     }
@@ -192,6 +205,19 @@ async function initAndConfigureServer() {
   showCreateOrEditServerModal.value = true
 }
 
+async function showNotificationAndReload(title: string, description: string) {
+  // show toast notification
+  setTimeout(() => {
+    notificationsStore.createNotification({
+      title: title,
+      description: description,
+      kind: 'success'
+    })
+  }, 500)
+  // reload server data
+  await reloadServer()
+}
+
 /**
  * When the ui pools the server loading, sometimes the load time is pretty big. The following
  * variable is only used in the interval pool below, so that the issue is mitigated.
@@ -283,6 +309,8 @@ onUnmounted(() => {
         :server="instanceData"
         @delete-server="showDeleteServerModal = true"
         @edit-server="showCreateOrEditServerModal = true"
+        @renew-server-certificate="showRenewServerCertificateModal = true"
+        @regenerate-all-certificates="showRegenerateAllCertificatesModal = true"
       />
 
       <RWAccountsManager
@@ -307,5 +335,28 @@ onUnmounted(() => {
       @close="showCreateOrEditServerModal = false"
       @add-edit-server="reloadServer"
     />
+    <RenewRWServerCertificateModal
+      :visible="showRenewServerCertificateModal"
+      :instance-name="instanceName"
+      @close="showRenewServerCertificateModal = false"
+      @server-certificate-renewed="
+        showNotificationAndReload(
+          t('standalone.openvpn_rw.server_certificate_renewed'),
+          t('standalone.openvpn_rw.server_certificate_renewed_message')
+        )
+      "
+    />
+    <RegenerateRWAllCertificatesModal
+      :visible="showRegenerateAllCertificatesModal"
+      :instance-name="instanceName"
+      :server-name="serverName"
+      @close="showRegenerateAllCertificatesModal = false"
+      @all-certificates-regenerated="
+        showNotificationAndReload(
+          t('standalone.openvpn_rw.all_certificates_regenerated'),
+          t('standalone.openvpn_rw.all_certificates_regenerated_message')
+        )
+      "
+    />
   </div>
 </template>