Edit

Update certificates

The guide describes the procedure of updating TLS certificates (server.crt, server.key, and ca.crt) on already installed Workfusion Intelligent Automation Cloud (IA Cloud) environment.

Example use cases:

• Workfusion IA Cloud was installed initially with self-signed TLS certificates, and you want to apply certificates issued by your trusted SSL provider (for example, GoDaddy, Digicert, etc.);
• Certificates used during initial installation expired, and you want to update them;

Prerequisites

• You have Workfusion Intelligent Automation Cloud v.10.1.0 or higher installed;
• You have SSH access to Linux servers of the environment - INT, BEP Master, BEP Agent, APP, OCR (if Linux was chosen as a platform for OCR);
• You have RDP access to Windows servers of the environment - RPA, BI (analytics), OCRWin (if Windows was chosen as a platform for OCR);
• You have no running Business Processes in the environment;
• You have prepared new server.crt, server.key, and ca.crt files.

Update certificates

For single-point setup

For multi-point setup

To update certificates:

1. Log in to the INT server via SSH as <linux_installation_user>, and gp to the directory where installer was extracted (PACKAGE_DIR):

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ cd $PACKAGE_DIR
   

2. Backup current certificates:

   $ mkdir certificates_backup
   $ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/
   

3. Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:

   $ ls -la certificates/
   total 24
   drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
   drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
   drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
   -rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
   -rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
   -rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
   

   Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.

4. Prepare the environment variables:

   $ export ANSIBLE_PRIVATE_KEY_FILE="</path_to_ssh_key>"   # Path to SSH key for connection to all Linux server as <linux_installation_user>
   $ export ANSIBLE_REMOTE_USER="<linux_installation_user>" # <linux_installation_user> provided in config.yml
   $ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"   # Password for decryption of config.yml. If you don't set this variable, you'll be prompted for password
   

5. Stop all services:

   $ ./install.sh stop_services full
   

6. Update certificates:

   $ ./install.sh update_certs full
   

7. Start all services:

   $ ./install.sh start_services full
   

8. Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

   $ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true
   
   # If you don't have OCR in the environment - don't use "-e test_ocr=true"
   # If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"
   

To update certificates:

1. Log in to the INT server via SSH as <linux_installation_user>, and gp to the directory where installer was extracted (PACKAGE_DIR):

   $ export PACKAGE_DIR=/opt/workfusion/wf_installer
   $ cd $PACKAGE_DIR
   

2. Backup current certificates:

   $ mkdir certificates_backup
   $ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/
   

3. Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:

   $ ls -la certificates/
   total 24
   drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
   drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
   drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
   -rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
   -rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
   -rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
   

   Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.

4. On the BI server, stop services (if BI server exists in the environment). For that, connect via RDP to the BI server, open Windows Powershell as Administrator, and execute:

   $ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"   # Password for decryption of config.yml. If you don't set this variable, you'll be prompted for password
   

5. Stop all services:

   $ ./install.sh stop_services full
   

6. Update certificates:

   $ ./install.sh update_certs full
   

7. Start all services:

   $ ./install.sh start_services full
   

8. Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

   $ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true
   
   # If you don't have OCR in the environment - don't use "-e test_ocr=true"
   # If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"
       ```