Update certificates

The guide describes the procedure of updating TLS certificates (server.crt, server.key, and ca.crt) on already installed Workfusion Intelligent Automation Cloud (IA Cloud) environment.

Example use cases:

Workfusion IA Cloud was installed initially with self-signed TLS certificates, and you want to apply certificates issued by your trusted SSL provider (for example, GoDaddy, Digicert, etc.);
Certificates used during initial installation expired, and you want to update them;

Prerequisites

You have Workfusion Intelligent Automation Cloud v.10.1.0 or higher installed.
You have the SSH access to Linux servers of the environment: Master, Agent.
You have RDP access to Windows servers of the environment: RPA, BI (Analytics).
You have no running Business Processes in the environment.
You have prepared new server.crt, server.key, and ca.crt files.

For single-point setup

For multi-point setup

To update certificates:

Log in to the Master server via SSH as WFUSER, and go to the directory where installer was extracted (PACKAGE_DIR):
```
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ cd $PACKAGE_DIR
```

Backup current certificates:

$ mkdir certificates_backup
$ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/

Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:
```
$ ls -la certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
-rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
```
Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.

Prepare the environment variables:

$ export ANSIBLE_PRIVATE_KEY_FILE="</path_to_ssh_key>"   # Path to SSH key for connection to all Linux server as WFUSER
$ export ANSIBLE_REMOTE_USER="WFUSER" # WFUSER provided in config.yml
$ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"   # Password for decryption of config.yml. If you don't set this variable, you'll be prompted for password

Stop all services:
```
$ ./install.sh stop_services full
```
Update certificates:
```
$ ./install.sh update_certs full
```
Start all services:
```
$ ./install.sh start_services full
```

Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

$ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true

# If you don't have OCR in the environment - don't use "-e test_ocr=true"
# If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"

To update certificates:

Log in to each linux server via SSH as WFUSER, and go to the directory where installer was extracted (PACKAGE_DIR):
```
$ export PACKAGE_DIR=/opt/workfusion/wf_installer
$ cd $PACKAGE_DIR
```

Backup current certificates:

$ mkdir certificates_backup
$ cp certificates/{server.crt,server.key,ca.crt} certificates_backup/

Place your new server.crt, server.key, and ca.crt into the certificates/ directory. The certificates/ directory content must look as follows:
```
$ ls -la certificates/
total 24
drwxr-xr-x.  3 ec2-user ec2-user   78 Oct 27 22:50 .
drwxr-xr-x. 12 ec2-user ec2-user 4096 Oct 27 22:50 ..
drwxrwxr-x.  2 ec2-user ec2-user 4096 Oct 27 22:50 _auth_internal
-rw-r--r--.  1 ec2-user ec2-user 2984 Oct 27 22:46 ca.crt
-rw-r--r--.  1 ec2-user ec2-user 4835 Oct 27 22:46 server.crt
-rw-r--r--.  1 ec2-user ec2-user 1674 Oct 27 22:46 server.key
```
Note: do not replace or remove files inside the _auth_internal directory. This directory contains client certificates for services intercommunication. The certificates are generated automatically before the initial installation and must not be changed.

Stop all services on linux servers. Execute on each linux server the following command:
```
$ wfmanager stop all
```
Stop services on the BI server(if BI server exists in the environment). For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm stop
```
Stop services on the RPA server(if RPA server exists in the environment). For that, connect via RDP to the RPA server, open Windows CMD as Administrator, and execute:
```
net stop WFSvc
```

Update certificates on master server(s):

$ ./install.sh update_certs master -c local --limit <current_host>

Update certificates on agent server(s):

$ ./install.sh update_certs agent -c local --limit <current_host>

Update certificates on RPA server(s):
1. In case ca.crt contains multiple certificates, extract the actual ca certificate (skip the intermediate) and save its contents in root.crt file
2. Copy certificates and keys to their corresponding locations on the RPA server, as described in the following table:
  
  server.crt -> rpa_install_dir\nginx\ssl\server.crt server.key -> rpa_install_dir\nginx\ssl\server.key ca.crt -> rpa_install_dir\nginx\ssl\ca.crt ca.crt -> rpa_install_dir\filebeat\ssl\ca.crt ca.crt -> rpa_install_dir\metricbeat\ssl\ca.crt root.crt -> rpa_install_dir\nginx\ssl\root.crt
3. Remove existing CA certificate with localCA alias from java truststore. For that, connect via RDP to the RPA server, open Windows CMD as Administrator, and execute:
```
**rpa_install_dir**\java\bin\keytool.exe -delete -noprompt -alias localCA -keystore **rpa_install_dir**\java\jre\lib\\security\cacerts -storepass changeit
```
1. Import new CA certificate with localCA alias into java truststore. For that, connect via RDP to the RPA server, open Windows CMD as Administrator, and execute:
```
**rpa_install_dir**\java\bin\keytool.exe -import -noprompt -alias localCA -file **rpa_install_dir**\nginx\ssl\root.crt 
    -keystore **rpa_install_dir**\java\jre\lib\security\cacerts -storepass changeit
```
1. Import CA certificate into Windows Trusted Root CA certificates store (LocalMachine storage). For that, connect via RDP to the RPA server, open Explorer and double-click the file rpa_install_dir\nginx\ssl\root.crt. Click "Install certificate" and select "Local Machine" as a destination. Then manually chose certificate store and select "Trusted Root Certificate Authorities".
2. Remove unnecessary rpa_install_dir\nginx\ssl\root.crt file from RPA server
Update certificates on BI server(s):
1. Copy certificates and keys to their corresponding locations on the BI server, as described in the following table:
  
  server.crt -> bi_install_dir/bi.crt server.key -> bi_install_dir/bi.key
2. Update Tableau configuration to use updated cert and key files. For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm security external-ssl enable --cert-file "**bi_install_dir**\bi.crt" --key-file "**bi_install_dir**\bi.key"
```
1. Apply pending changes for Tableau server. For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm pending-changes apply
```
Start all services on linux servers. Execute on each linux server the following command:
```
$ wfmanager start all
```
Start services on the RPA server(if RPA server exists in the environment). For that, connect via RDP to the RPA server, open Windows CMD as Administrator, and execute:
```
net start WFSvc
```
Start services on the BI server(if BI server exists in the environment). For that, connect via RDP to the BI server, open Windows CMD as Administrator, and execute:
```
tsm start
```

Wait for about 10 minutes for environment stabilization after services startup, and check that environment is operational:

$ ./install.sh check full -e test_ml=true -e test_ocr=true -e test_rpa=true -e test_ie=true -e test_desktop=true

# If you don't have OCR in the environment - don't use "-e test_ocr=true"
# If you don't have RPA in the environment - don't use "-e test_rpa=true -e test_ie=true -e test_desktop=true"
    ```

WorkFusion Documentation

10.2

Hardware

Install Linux components

Keycloak administrator guide

Update certificates

Prerequisites

Update certificates