10.0

Edit

Update TLS certificates

After the installation, you can update the SSL certificates on all Linux servers with a single install.sh script.

Prerequisites

  • New SSL certificates must be located in the certificates directory (PACKAGE_DIR/certificates).

  • Run these steps as the installation user.

  • Available <server-role> are as follows:

    • int: INT server
    • bep-master: BEP Master server
    • bep-agent: BEP Agent server
    • app: APP server
    • ocr: OCR server
    • apm: if you use APM server separately

Update certificates

Before updating the existing certificates, they must be already generated. For more information, see Prepare TLS certificates for installation.

To update certificates:

  1. From the PACKAGE_DIR/certificates directory on the INT server, remove the certificates that you are going to update.

  2. On the INT server, generate the missing certificates once again. See Prepare TLS certificates for installation.

  3. Update the certificates, depending on your installation approach:

    • Single-point setup:

      1. Make sure that the following variables are exported:

        $ export ANSIBLE_PRIVATE_KEY_FILE="<path-to-private-linux-installation-key>"
$ export ANSIBLE_REMOTE_USER="<installation-user>"

      2. Go to the PACKAGE_DIR directory and run the script to update the certificates for a chosen server role:

        $ cd PACKAGE_DIR
$ ./install.sh update_certs <server-role>

      Update certificates for all server roles in the following order: INT > BEP Master > BEP Agents > APP > OCR (Linux) > APM (if you use APM separately).

    • Legacy setup:

      1. Copy the newly generated certificates from the initial PACKAGE_DIR/certificates directory on the INT server to the same PACKAGE_DIR/certificates directory on other Linux servers: BEP master, BEP agents, APP, OCR, APM (if you use APM separately).

      2. On each Linux server, run the following command with the specified server role to update certificates and distribute them among required services:

        $ cd PACKAGE_DIR
$ ./install.sh update_certs <server-role>

        Replace <server_role> with the respective server role. See the supported values earlier.
        For example:

        <APP-server> ~installation-user$ ./install.sh update_certs app
# or
<OCR-server> ~installation-user$ ./install.sh update_certs ocr
note

The script does not update the *.p12 Vault certificates. To update the Vault certificates, see Update passwords.

Run post-installation checks

To check that the certificates are updated correctly, run the following command:

$ ./install.sh check <SERVER_ROLE>
← PreviousUpdate passwords →