Update certificates

The guide describes the procedure of updating the server.crt, server.key, and ca.crt TLS certificates on the installed Workfusion Intelligent Automation Cloud (IA Cloud) environment.

Example use cases:

Workfusion IA Cloud was initially installed with self-signed TLS certificates, and you want to apply certificates issued by your trusted SSL provider, for example, GoDaddy, Digicert, and so on.
Certificates used during initial installation expired, and you want to update them.

Prerequisites

You have Workfusion Intelligent Automation Cloud v.10.1.0 or higher installed.
You have the SSH access to the Linux servers of the environment.
You have RDP access to Windows servers of the environment: RPA, BI (Analytics).
You have no running Business Processes in the environment.
You have prepared new server.crt, server.key, and ca.crt files.

For single-point setup

For multi-point setup

To update certificates:

Log in to the APP server via SSH as <wf_user>, and go to the directory where installer was extracted (PACKAGE_DIR):
```
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ cd $PACKAGE_DIR
```

Backup current certificates:

$ mkdir certificates_backup
$ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/

Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:
```
$ ls -la certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
-rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
```
Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.

Prepare the environment variables:

$ export ANSIBLE_PRIVATE_KEY_FILE="</path_to_ssh_key>"   # Path to SSH key for connection to all Linux server as <wf_user>
$ export ANSIBLE_REMOTE_USER="<wf_user>" # <wf_user> provided in config.yml
$ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"   # Password for decryption of config.yml. If you don't set this variable, you'll be prompted for password

Stop all services:
```
$ ./install.sh stop_services full
```
Update certificates:
```
$ ./install.sh update_certs full
```
Start all services:
```
$ ./install.sh start_services full
```

Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

$ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true

# If you don't have OCR in the environment - don't use "-e test_ocr=true"
# If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"

To update certificates:

Log in to each Linux server via SSH as <wf_user>, and go to the directory where installer was extracted (PACKAGE_DIR):
```
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ cd $PACKAGE_DIR
```

Backup current certificates:

$ mkdir certificates_backup
$ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/

Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:
```
$ ls -la certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
-rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
```
Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.
On each Linux server, stop all services:
```
$ wfmanager stop all
```
Stop services on the BI server(if BI server exists in the environment). For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm stop
```
Stop services on the RPA server(if RPA server exists in the environment). For that, connect via RDP to the RPA server, open Windows CMD as Administrator, and execute:
```
net stop WFSvc
```

Update certificates on the APP server(s):

$ ./install.sh update_certs app -c local --limit <current_host>

Update certificates on BEP Agent server(s):

$ ./install.sh update_certs bep-agent -c local --limit <current_host>

Update certificates on RPA server(s):
1. In case ca.crt contains multiple certificates, extract the actual CA certificate (skip the intermediate) and save its contents to the root.crt file.
2. Copy certificates and keys to their corresponding locations on the RPA server, as described in the following table:
  - server.crt -> rpa_install_dir\nginx\ssl\server.crt
  - server.key -> rpa_install_dir\nginx\ssl\server.key
  - ca.crt -> rpa_install_dir\nginx\ssl\ca.crt
  - ca.crt -> rpa_install_dir\filebeat\ssl\ca.crt
  - ca.crt -> rpa_install_dir\metricbeat\ssl\ca.crt
  - root.crt -> rpa_install_dir\nginx\ssl\root.crt
3. Remove existing CA certificate with localCA alias from java truststore. For that, connect to the RPA server via RDP, open Windows CMD as Administrator, and execute:
```
**rpa_install_dir**\java\bin\keytool.exe -delete -noprompt -alias localCA -keystore **rpa_install_dir**\java\jre\lib\\security\cacerts -storepass changeit
```
4. Import a new CA certificate with localCA alias into java truststore. For that, connect to the RPA server via RDP, open Windows CMD as Administrator, and execute:
```
**rpa_install_dir**\java\bin\keytool.exe -import -noprompt -alias localCA -file **rpa_install_dir**\nginx\ssl\root.crt 
-keystore **rpa_install_dir**\java\jre\lib\security\cacerts -storepass changeit
```
5. Import CA certificate into Windows Trusted Root CA certificates store (LocalMachine storage). For that, connect via RDP to the RPA server, open Explorer, and double-click the file rpa_install_dir\nginx\ssl\root.crt. Click Install certificate and select Local Machine as a destination. Then manually chose the certificate store and select Trusted Root Certificate Authorities.
6. On the RPA server, remove unnecessary rpa_install_dir\nginx\ssl\root.crt file.
Update certificates on the BI server(s):
1. Copy certificates and keys to their corresponding locations on the BI server, as described in the following table:
  - server.crt -> bi_install_dir/bi.crt
  - server.key -> bi_install_dir/bi.key
2. Update Tableau configuration to use updated cert and key files. For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm security external-ssl enable --cert-file "**bi_install_dir**\bi.crt" --key-file "**bi_install_dir**\bi.key"
```
3. Apply pending changes for the Tableau server. For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm pending-changes apply
```
On each Linux server, start all services:
```
$ wfmanager start all
```
If the RPA server exists in the environment, connect to the RPA server via RDP, open Windows CMD as Administrator, and run the following command to start services:
```
net start WFSvc
```
If the BI server exists in the environment, connect to the BI server via RDP, open Windows CMD as Administrator, and run the following command to start services:
```
tsm start
```

Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

$ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true

# If you don't have OCR in the environment - don't use "-e test_ocr=true"
# If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"

WorkFusion Documentation

10.1.4.1

Hardware

Install Linux components

Install OCR Windows server

Security settings in Control Tower

Update certificates

Prerequisites

Update certificates