10.1.2

Edit

Update certificates

After the installation, you can update the SSL certificates on all Linux servers with a single install.sh script.

Prerequisites

  • New SSL certificates must be located in the certificates directory (PACKAGE_DIR/certificates).

  • Run these steps as the installation user (wf_user in config.yml).

  • Available <server-role> are as follows:

    • full: all servers
    • int: INT server
    • bep-master: BEP Master server
    • bep-agent: BEP Agent server
    • app: APP server
    • ocr: OCR server
    • ocrwin: OCR Windows server (if used instead of Linux OCR)
    • rpa: RPA server (only for single-point setup)
    • bi: Analytics server

Update certificates

Before updating the existing certificates, they must be already generated. For more information, see Prepare certificates.

To update certificates:

  1. From the PACKAGE_DIR/certificates directory on the INT server, remove the certificates that you are going to update.

  2. On the INT server, generate the missing certificates once again. See Prepare certificates.

  3. Update the certificates, depending on your installation approach:

    • Single-point setup:

      1. Make sure that the following variables are exported:

        $ export ANSIBLE_PRIVATE_KEY_FILE="<path-to-private-linux-installation-key>"
$ export ANSIBLE_REMOTE_USER="<installation-user>"

      2. Go to the PACKAGE_DIR directory and run the script to update the certificates for a chosen server role:

        $ cd PACKAGE_DIR
$ ./install.sh update_certs <server-role>

      Update certificates for all server roles in the following order: INT > BEP Master > BEP Agents > APP > OCR (Linux) > RPA.

    • Legacy setup:

      1. Copy the newly generated certificates from the initial PACKAGE_DIR/certificates directory on the INT server to the same PACKAGE_DIR/certificates directory on other Linux servers (BEP master, BEP agents, APP, OCR Linux).

      2. On each Linux server, run the following command with the specified server role to update certificates and distribute them among required services:

        $ cd PACKAGE_DIR
$ ./install.sh update_certs <server-role>

        Replace <server_role> with the respective server role. See the supported values earlier.
        For example:

        <APP-server> ~installation-user$ ./install.sh update_certs app
# or
<OCR-server> ~installation-user$ ./install.sh update_certs ocr

      Update certificates for all server roles in the following order: INT > BEP Master > BEP Agents > APP > OCR (Linux) > RPA.

note

The script does not update the *.p12 Vault certificates. To update the Vault certificates, see Update passwords.

Run post-installation checks

To check that the certificates are updated correctly, run the following command:

$ ./install.sh check <SERVER_ROLE>
← PreviousUpdate passwords →