Rotating the SSL certificate

Use the SSL rotation utility tool to rotate the existing SSL certificate. It is recommended that you rotate the SSL certificate each time you upgrade the UCP Advisor software.

1. Copy the SSL rotation utility either from the Service Console VM or extract the SSL rotation utility from the UCP Advisor media kit.
   • Copy the SSL rotation utility from the Service Console VM:
     1. Using an SSH client, such as PuTTy, log on to the Service Console VM as a root user.
     2. Navigate to the /home/ucpadmin/ServiceConsole/vc/cmd-update-tool/installer/scripts folder.
     3. Copy the ssl-rotation-keystore.sh to the Master Node VM. Enter:

        # scp ssl-rotation-keystore.sh root@<master-node-IP>:/var/ucpadvisor/ssl/certs

     4. Log on to the Master Node VM as a ucpadmin user.
     5. Navigate to the /var/ucpadvisor/ssl/certs folder.
   • Extract the SSL rotation utility from the UCP Advisor media kit:
     1. Using an SSH client, such as PuTTY, log on to the UCP Advisor Master Node as a root or a sudo user.
     2. Extract the UCP Advisor upgrade file:

        sudo tar -xvzf ucpadvisor-air-gapped-v4.4.0-xxx.tar.gz

     3. Navigate to the /installer/scripts folder.
2. Set executable permissions for the SSL rotation utility tool. Enter:

   # sudo chmod +x ssl-rotation-keystore.sh
   # ls
   # ssl-rotation-keystore.sh

3. Run the SSL rotation utility tool on the Master Node of the Kubernetes cluster. Enter:

   # sudo ./ssl-rotation-keystore.sh --worker=<worker node 1 IP address> --worker=<worker node 2 IP address>

   For a one-node configuration, enter the following command:

   sudo ./ssl-rotation-keystore.sh

   Answer the prompts accordingly.

   Note: The Master Node VM restarts, which will cause a few minutes of downtime for UCP Advisor.
4. Verify that all the Kubernetes pods are up and running. Enter:

   kubectl get pods -n ucp -w

   Note: All the pods must be in the Running state.

   [root@c79-20-208 ~]# kubectl get pods -n ucp -w
   NAME                                                  READY   STATUS    RESTARTS   AGE
   common-operator-8585947c84-ngdxr                      2/2     Running   2          160m
   converged-operator-5dcc6b4cf-sgpwq                    2/2     Running   0          160m
   day0-ccdb6fcf8-xb569                                  2/2     Running   0          160m
   elasticsearch-0                                       1/1     Running   0          160m
   filemanager-7cc9bcc8f8-d7zz6                          1/1     Running   0          160m
   hypervisor-operator-5cf74cb64f-zmsr6                  2/2     Running   0          160m
   idm-8466fb7c76-tqvhw                                  1/1     Running   0          160m
   keycloak-f65dffb8c-btnm9                              1/1     Running   0          160m

5. Verify that the SSL certificate was successfully rotated. Navigate to the /var/ucpadvisor/ssl/certs/common folder, and enter:

   sudo openssl x509 -enddate -noout -in server.crt

   Sample output:

   notAfter=Sep 13 20:14:46 2024 GMT

   Note: If you see the No route matched with those values error when you log on to UCP Advisor after rotating the SSL certificate, then restart the Kong pod. Run the following command on the Master Node VM:

   kubectl rollout restart deploy ucpadvisor-kong -n ucp