Renewing Puppet Certificates - Revision history

Khtang: /* 2024 Reattempt to Renew Certificates */

2024-05-10T20:48:06Z

2024 Reattempt to Renew Certificates

← Older revision		Revision as of 20:48, 10 May 2024
Line 288:		Line 288:
	# Delete old certificates		# Delete old certificates

	[root@mk-auth ~]# certutil -D d /etc/dirsrv/slapd-mk-auth n "Cluster PuppetCA Certificate"		[root@mk-auth ~]# certutil -D -d /etc/dirsrv/slapd-mk-auth -n "Cluster PuppetCA Certificate"

	[root@mk-auth ~]# certutil -D -d /etc/dirsrv/slapd-mk-auth/ -n "mk-auth.c.keiserlab.org"		[root@mk-auth ~]# certutil -D -d /etc/dirsrv/slapd-mk-auth/ -n "mk-auth.c.keiserlab.org"

Jgutierrez6: /* 2024 Reattempt to Renew Certificates */

2024-04-09T21:14:43Z

2024 Reattempt to Renew Certificates

← Older revision		Revision as of 21:14, 9 April 2024
Line 170:		Line 170:
	Prior to this expiration date, you must act!		Prior to this expiration date, you must act!

	~~'''~~Generating New Puppet CAs and Certificates on Puppet Master~~'''~~		Generating New Puppet CAs and Certificates on Puppet Master

	Puppet certificates and CAs are stored in mk-manage, the Puppet/Foreman server. Puppet stores the certificates in /var/lib/puppet/ssl.		Puppet certificates and CAs are stored in mk-manage, the Puppet/Foreman server. Puppet stores the certificates in /var/lib/puppet/ssl.

Jgutierrez6: /* 2024 Reattempt to Renew Certificates */

2024-04-09T21:13:14Z

2024 Reattempt to Renew Certificates

← Older revision		Revision as of 21:13, 9 April 2024
Line 170:		Line 170:
	Prior to this expiration date, you must act!		Prior to this expiration date, you must act!

	Generating New Puppet CAs and Certificates on Puppet Master		'''Generating New Puppet CAs and Certificates on Puppet Master'''

	Puppet certificates and CAs are stored in mk-manage, the Puppet/Foreman server. Puppet stores the certificates in /var/lib/puppet/ssl.		Puppet certificates and CAs are stored in mk-manage, the Puppet/Foreman server. Puppet stores the certificates in /var/lib/puppet/ssl.

Jgutierrez6: /* 2024 Reattempt to Renew Certificates */

2024-04-09T21:12:39Z

2024 Reattempt to Renew Certificates

← Older revision		Revision as of 21:12, 9 April 2024
Line 156:		Line 156:
	# Khanh and I followed these set of instructions first		# Khanh and I followed these set of instructions first
	#* https://web.archive.org/web/20181005000544/https://blog.flyingcircus.io/2017/09/01/how-to-renew-puppet-ca-and-server-certificates-in-place/		#* https://web.archive.org/web/20181005000544/https://blog.flyingcircus.io/2017/09/01/how-to-renew-puppet-ca-and-server-certificates-in-place/
	# Then we followed the		# Then we followed the '''Edit Certificate Databases on LDAPS server mk-auth'''
	# <source>		#: <source>
	This page is in regards to SSL certs that are created by Puppet which are then used by Foreman and LDAPS. SSL Certs expire every five years.		This page is in regards to SSL certs that are created by Puppet which are then used by Foreman and LDAPS. SSL Certs expire every five years.

Jgutierrez6 at 21:06, 9 April 2024

2024-04-09T21:06:55Z

Show changes

Benrwong: /* Libvirt, Hypervisors, and TLS */ correction of paths

2019-05-10T23:22:07Z

Libvirt, Hypervisors, and TLS: correction of paths

← Older revision		Revision as of 23:22, 10 May 2019
Line 137:		Line 137:
	copy /var/lib/puppet/ssl/certs/ca.pem to /etc/pki/CA/cacert.pem		copy /var/lib/puppet/ssl/certs/ca.pem to /etc/pki/CA/cacert.pem
	copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem		copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem
	copy /var/lib/puppet/ssl/private_keys/<hostname>.pem to /etc/pki/libvirt/serverkey.pem		copy /var/lib/puppet/ssl/private_keys/<hostname>.pem to /etc/pki/libvirt/private/serverkey.pem
	service libvirtd restart (if you did anything wrong, this will fail. Be careful)		service libvirtd restart (if you did anything wrong, this will fail. Be careful)

Benrwong: /* Libvirt, Hypervisors, and TLS */

2019-05-10T23:20:28Z

Libvirt, Hypervisors, and TLS

← Older revision		Revision as of 23:20, 10 May 2019
Line 137:		Line 137:
	copy /var/lib/puppet/ssl/certs/ca.pem to /etc/pki/CA/cacert.pem		copy /var/lib/puppet/ssl/certs/ca.pem to /etc/pki/CA/cacert.pem
	copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem		copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem
	copy /var/lib/puppet/ssl~~/certs~~/private_keys/<hostname>.pem to /etc/pki/libvirt/serverkey.pem		copy /var/lib/puppet/ssl/private_keys/<hostname>.pem to /etc/pki/libvirt/serverkey.pem
	service libvirtd restart (if you did anything wrong, this will fail. Be careful)		service libvirtd restart (if you did anything wrong, this will fail. Be careful)

Benrwong: /* Possible Other Errors */

2019-05-10T18:58:43Z

Possible Other Errors

← Older revision		Revision as of 18:58, 10 May 2019
Line 142:		Line 142:
	===Possible Other Errors===		===Possible Other Errors===

	I am getting this when trying to remove a host: "Remove Reverse DNS record for n-5-35.cluster.ucsf.bkslab.org task failed with the following error: ERF12-1261 [ProxyAPI::ProxyException]: Unable to delete DNS entry ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: sslv3 alert ce...) for proxy https://foreman.cluster.ucsf.bkslab.org:8443/dns"		I was getting this when trying to remove a host: "Remove Reverse DNS record for n-5-35.cluster.ucsf.bkslab.org task failed with the following error: ERF12-1261 [ProxyAPI::ProxyException]: Unable to delete DNS entry ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: sslv3 alert ce...) for proxy https://foreman.cluster.ucsf.bkslab.org:8443/dns"

	This was a foreman SSL error. This happened because foreman was still using the old SSL certs that existed in /var/lib/puppet/ssl/certs. It was referencing a certificate file called alpha.cluster.ucsf.bkslab.org. The certificate I renewed was called alpha.ucsf.bkslab.org. I had to go to foreman.ucsf.bkslab.org then click Administer -> Settings -> Auth. I had to adjust the lines for ssl_certificate and ssl_priv_key to point to the new certificates I made. Then, foreman-proxy was working again.		This was a foreman SSL error. This happened because foreman was still using the old SSL certs that existed in /var/lib/puppet/ssl/certs. It was referencing a certificate file called alpha.cluster.ucsf.bkslab.org. The certificate I renewed was called alpha.ucsf.bkslab.org. I had to go to foreman.ucsf.bkslab.org then click Administer -> Settings -> Auth. I had to adjust the lines for ssl_certificate and ssl_priv_key to point to the new certificates I made. Then, foreman-proxy was working again.

	===Further Reading===		===Further Reading===

Benrwong: /* Libvirt, Hypervisors, and TLS */

2019-05-10T18:58:23Z

Libvirt, Hypervisors, and TLS

← Older revision		Revision as of 18:58, 10 May 2019
Line 128:		Line 128:

	===Libvirt, Hypervisors, and TLS===		===Libvirt, Hypervisors, and TLS===
	alpha/puppetmaster is used to manage the VMs. To add to the hassle of renewing Puppet certificates, we also have to copy the renewed certificates to ~~several locations~~ on both the puppetmaster AND the hypervisors.		alpha/puppetmaster is used to manage the VMs. To add to the hassle of renewing Puppet certificates, we also have to copy the renewed certificates to the libvirt-relevant sections on both the puppetmaster AND the hypervisors. Otherwise, foreman cannot interact with the hypervisors/VMs.

	Only do this once on the puppetmaster (hostname will depend on which name you used while regenerating SSL certs. I used alpha.ucsf.bkslab.org.pem):		Only do this once on the puppetmaster (hostname will depend on which name you used while regenerating SSL certs. I used alpha.ucsf.bkslab.org.pem):
Line 138:		Line 138:
	copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem		copy /var/lib/puppet/ssl/certs/<hostname>.pem to /etc/pki/libvirt/servercert.pem
	copy /var/lib/puppet/ssl/certs/private_keys/<hostname>.pem to /etc/pki/libvirt/serverkey.pem		copy /var/lib/puppet/ssl/certs/private_keys/<hostname>.pem to /etc/pki/libvirt/serverkey.pem
	service libvirtd restart (if you did anything wrong, this will fail. Be careful)		service libvirtd restart (if you did anything wrong, this will fail. Be careful)

	===Possible Other Errors===		===Possible Other Errors===

Benrwong: /* Renewing Foreman's certificates (in progress) */

2019-05-10T18:57:21Z

Renewing Foreman's certificates (in progress)

← Older revision		Revision as of 18:57, 10 May 2019
Line 117:		Line 117:

	openssl rsa -in foreman.key -out foreman.key-unlocked		openssl rsa -in foreman.key -out foreman.key-unlocked

			# this section doesn't need to be done if they symlinks already exist
	ln -s foreman.key-unlocked key.pem		ln -s foreman.key-unlocked key.pem
	ln -s foreman.crt cert.pem		ln -s foreman.crt cert.pem

	Restart httpd when this is done.		Restart httpd when this is done.

	===Clearing old certificates===		===Clearing old certificates===