UpdateCertificates - Revision history

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Renew Certificates */

2017-05-03T11:52:45Z

Renew Certificates

← Older revision		Revision as of 11:52, 3 May 2017
Line 69:		Line 69:

	next step is to update all the quattor files and to make the clients connect for their new certificates. <br>		next step is to update all the quattor files and to make the clients connect for their new certificates. <br>
	For this, put the private templates on '''qclig''', /opt/~~CB6~~/private ~~or /opt/CB5/private, in the appropriate glite version dir~~.		For this, put the private templates on '''qclig''', /opt/CB9/private.
	<pre>		<pre>
	cd /opt/CB9/svncheck/		cd /opt/CB9/svncheck/

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Renew Certificates */

2017-03-21T15:54:08Z

Renew Certificates

← Older revision		Revision as of 15:54, 21 March 2017
Line 112:		Line 112:
	If this is not enough think of restarting the node.		If this is not enough think of restarting the node.

	If the DN of the machine changes (new certificate provider, ...) then its need to be added explicitly into the template of argus. The affected variable is PAP_HOST_DN.		If the DN of the machine changes (new certificate provider, ...) then its need to be added explicitly into the template of argus. The affected variable is PAP_HOST_DN. <br>
	'''IMPORTANT:''' the DN can change even while staying with the same provider! Check the old and the new DN with		'''IMPORTANT:''' the DN can change even while staying with the same provider! Check the old and the new DN with

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Renew Certificates */

2017-03-21T15:53:33Z

Renew Certificates

← Older revision		Revision as of 15:53, 21 March 2017
Line 113:		Line 113:

	If the DN of the machine changes (new certificate provider, ...) then its need to be added explicitly into the template of argus. The affected variable is PAP_HOST_DN.		If the DN of the machine changes (new certificate provider, ...) then its need to be added explicitly into the template of argus. The affected variable is PAP_HOST_DN.
			'''IMPORTANT:''' the DN can change even while staying with the same provider! Check the old and the new DN with

			<pre>
			openssl x509 -in /etc/grid-security/hostcert.pem -noout -subject
			</pre>

	'''9.''' (Optional) Adapt GOCDB server entry		'''9.''' (Optional) Adapt GOCDB server entry

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Renew Certificates */

2017-03-17T14:50:54Z

Renew Certificates

← Older revision		Revision as of 14:50, 17 March 2017
Line 51:		Line 51:
	issue:		issue:
	<pre>		<pre>
	./certificate_tool.py --mode=extract --dir=/root/new-cert/		/root/new-cert/certificate_tool.py --mode=extract --dir=/root/new-cert/
	</pre>		</pre>
	Look in PemDir, there should be as many .pem files as you put .zip files. <br>		Look in PemDir, there should be as many .pem files as you put .zip files. <br>
Line 61:		Line 61:
	Next, issue		Next, issue
	<pre>		<pre>
	/~~opt~~/~~CB6/tmp/src/begrid/cb~~-~~client~~/certificate_tool.py --mode=get --dir=/root/new-cert/ --debug		/root/new-cert/certificate_tool.py --mode=get --dir=/root/new-cert/ --debug
	</pre>		</pre>
	all the certificates templates will be saved in /root/new-cert/private. <br> <br>		all the certificates templates will be saved in /root/new-cert/private. <br> <br>

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Create New Certificate */

2017-03-17T14:50:28Z

Create New Certificate

← Older revision		Revision as of 14:50, 17 March 2017
Line 35:		Line 35:
	To create a new certificate, do:		To create a new certificate, do:
	<pre>		<pre>
	/~~opt~~/~~CB6/tmp/src/begrid/cb~~-~~client~~/certificate_tool.py --mode=new --dir=/root/new-cert/ --att=OU=IIHE,CN=behar050.iihe.ac.be,emailAddress=grid_admin@listserv.vub.ac.be --debug		/root/new-cert/certificate_tool.py --mode=new --dir=/root/new-cert/ --att=OU=IIHE,CN=behar050.iihe.ac.be,emailAddress=grid_admin@listserv.vub.ac.be --debug
	</pre>		</pre>

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Create New Certificate */

2017-03-17T14:09:31Z

Create New Certificate

← Older revision		Revision as of 14:09, 17 March 2017
Line 37:		Line 37:
	/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py --mode=new --dir=/root/new-cert/ --att=OU=IIHE,CN=behar050.iihe.ac.be,emailAddress=grid_admin@listserv.vub.ac.be --debug		/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py --mode=new --dir=/root/new-cert/ --att=OU=IIHE,CN=behar050.iihe.ac.be,emailAddress=grid_admin@listserv.vub.ac.be --debug
	</pre>		</pre>

			Then, upload the -req- file to digicert. Only Shkelzen and Olivier have the correct authorizations to do this. Ask them to do it for you.

	==== Renew Certificates ====		==== Renew Certificates ====
	With the old crt (that can be found in the -req- files, you can renew your certificateS. Most should have an automatic renewal, so nothing needs to be done.<br>		With the old crt (that can be found in the -req- files, you can renew your certificateS. Most should have an automatic renewal, so nothing needs to be done.<br>

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Procedure */

2017-03-17T14:08:21Z

Procedure

← Older revision		Revision as of 14:08, 17 March 2017
Line 11:		Line 11:
	Log in on '''qnat''' and generate all the necessary certificates with this tool:		Log in on '''qnat''' and generate all the necessary certificates with this tool:
	<pre>		<pre>
	/~~opt~~/~~CB6/tmp/src/begrid/cb~~-~~client~~/certificate_tool.py		/root/new-cert/certificate_tool.py
	</pre>		</pre>
	the tools help output gives:		the tools help output gives:

OLIVIER DEVROEDE omdevroe@vub.ac.be: /* Renew Certificates */

2017-03-17T14:07:31Z

Renew Certificates

← Older revision		Revision as of 14:07, 17 March 2017
Line 38:		Line 38:
	</pre>		</pre>
	==== Renew Certificates ====		==== Renew Certificates ====
	To renew ~~all certificates~~, ~~first remove all~~ .~~pem files in /root/new-cert/~~. ~~Move~~ the ~~.tpl~~ files ~~from /root/new-cert/private to~~ /root/new-cert/. ~~Then~~, ~~remove~~ everything from the 2 subdirectories (private and PemDir)<br>		With the old crt (that can be found in the -req- files, you can renew your certificateS. Most should have an automatic renewal, so nothing needs to be done.<br>
	~~Then Do~~:
			'''1.'''

			Download all the zip files containing the certificates and put them in /root/new-cert/Zips . To avoid mixing things up, better to first empty this directory<br>


			Remove everything from the 2 subdirectories private and PemDir. Their contents will be regenerated<br>
			issue:
	<pre>		<pre>
	~~/opt/CB6/tmp/src/begrid/cb-client~~/certificate_tool.py --mode=~~renew~~ --dir=/root/new-cert/ ~~--debug~~		./certificate_tool.py --mode=extract --dir=/root/new-cert/
	</pre>		</pre>
	~~'''2.'''All the keys need to~~ be ~~uploaded one by one to the belnet site~~. ~~Go to https://gridra~~.~~belnet~~.be ~~, click "Request a Certificate", choose server from~~ the ~~drop down box~~. ~~Upload~~ one ~~generate certificate (~~the ~~ones with -req)~~. ~~On OU needs to be added~~. ~~For this chose~~ '~~VUB~~'. ~~<br> <br>~~		Look in PemDir, there should be as many .pem files as you put .zip files. <br>
			If not, some certificates might be in the wrong format. You can always download the correct one from the DigiCert interface. Just click on the certificate number and download in crt format. <br>


			'''2.'''

	~~'''3.''' All the generated certificates will be send via mail. Download them all (choose only the one ending in _iihe_ac_be.pem from every mail) and put them in /root/new-cert/PemDir and do:~~		Next, issue
	<pre>		<pre>
	/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py --mode=get --dir=/root/new-cert/ --debug		/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py --mode=get --dir=/root/new-cert/ --debug
	</pre>		</pre>
	all the certificates templates will be saved in /root/new-cert/private. <br> <br>		all the certificates templates will be saved in /root/new-cert/private. <br> <br>
	'''4.''' next step is to update all the quattor files and to make the clients connect for their new certificates. <br>
	For this, put the private templates on ~~ccq3~~, /opt/CB6/private or /opt/CB5/private, in the appropriate glite version dir.
			'''3.'''

			next step is to update all the quattor files and to make the clients connect for their new certificates. <br>
			For this, put the private templates on '''qclig''', /opt/CB6/private or /opt/CB5/private, in the appropriate glite version dir.
	<pre>		<pre>
	cd /opt/~~CB6~~/svncheck/		cd /opt/CB9/svncheck/
	./runcheck		./runcheck
	</pre>		</pre>
	'''5.''' This will broadcast a message to all the machines and they will respond within 5 minutes and start updating. All services except one will update fine <br> <br>
	'''6.''' We now check that the update was complete and for this we first log in to '''maite'''.
			'''4.'''

			This will broadcast a message to all the machines and they will respond within 5 minutes and start updating. All services except one will update fine <br> <br>
			'''5.'''

			We now check that the update was complete and for this we first log in to '''maite'''.
	<pre>		<pre>
	grep filecopy /var/log/ncm-cdispd.log		grep filecopy /var/log/ncm-cdispd.log

Olivier Devroede: /* Procedure */

2016-05-17T09:17:50Z

Procedure

← Older revision		Revision as of 09:17, 17 May 2016
Line 9:		Line 9:
	=== Procedure ===		=== Procedure ===

	Log in on '''~~ccq3~~''' and generate all the necessary certificates with this tool:		Log in on '''qnat''' and generate all the necessary certificates with this tool:
	<pre>		<pre>
	/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py		/opt/CB6/tmp/src/begrid/cb-client/certificate_tool.py

Olivier Devroede: /* Update and request server certificates */

2016-05-17T09:16:48Z

Update and request server certificates

← Older revision		Revision as of 09:16, 17 May 2016
Line 2:		Line 2:
	== Update and request server certificates ==		== Update and request server certificates ==

	~~----~~
	=== Introduction ===		=== Introduction ===
	All certificates for our machines will have to be updated every year. We will receive mails starting 2 weeks before the certificates expire. <br>		All certificates for our machines will have to be updated every year. We will receive mails starting 2 weeks before the certificates expire. <br>