Synchronize x509 user certificates

Because of the second corona wave we try improve our VPN capabilities.

Currently we have ~1000 SSL-VPN user on a SG230 (only some 100 connect at a time right now, but number will grow).

The accounts are synchronized to AD SSO and manually added to the VPN group.

Now we want to throw another SG230 (currently only used for WAF and mail filtering) in the ring.

Both systems are in production and cannot be re-imaged or set to a HA config.

My current approach is

• configure the VPN similar to the first one (other VPN IP network subset and other internet line though)
• add a user to the second SD with identical settings of the first SG
• export x509 user cert from first SG as .p12
• import it to the second
• assign this cert to the user, erase the previously auto-generated

VPN host cert is also imported and identical from first to second SG

If I connect the user to the second SG (either by DNS round-robin or manual override) everything works as expected

Is there a way to avoid doing the above steps manually for each user?

Adding a user in the GUI is easy, but then a new (other) x509 certificate is being auto-generated.

Exporting the certificate (.p12), importing it in the second SG and assigning it is much effort anyway.

Is there an easier way to do this?

I know the threads about user mass-creating using cc, but none seemed to be a supported solution, just console hacking.

Additionally, there is also no solution to synchronize the certificates.

I've seen, the system configuration can also exported in configd format (xml).

Is there a way to import only parts of this configuration (user accounts and their certificates)?