Connectrix SANnav：将 SSL 证书替换为 CA 签名后代理服务未启动

[VMware] root@olsannav.kba.de /opt/sannav/Portal_2.4.0_bld249/bin # sh ./replace-sannav-certificates.sh

Enter the path for the chained CA certificate including the file name (If you have an intermediate certificate chain the same with root and provide the path including file name.) :
/tmp/ca-chain.crt

Enter the path for the private key including the file name :
/tmp/olsannav.kba.de.key

Enter the password for private key (/tmp/olsannav.kba.de.key). If the private key is not password protected, press Enter :

Enter the path for the SSL certificate to be installed on olsannav.kba.de including the file name. Ensure that the Common Name of the certificate matches the FQDN of the host olsannav.kba.de.
/tmp/olsannav.kba.de.crt
No extensions in certificate

Successfully validated the certificate and the private key.
Stopping the SANnav Management Portal server to apply the certificates.
Stopped the SANnav Management Portal server to apply the certificates.
Starting SANnav Management Portal services.
Services have been started.
Waiting and checking for SANnav server to be ready. This may take a few minutes.
[|]
Some services are still not up. Run the script (/opt/sannav/Portal_2.4.0_bld249/bin/check-sannav-status.sh) to check SANnav startup status.
If all services are not up after an additional 15 minutes, run the troubleshooting script (/opt/sannav/Portal_2.4.0_bld249/bin/troubleshooting-sannav.sh) to resolve any reported issues and restart SANnav.

代理服务的 Docker 容器显示以下错误：

/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up

2025/05/30 11:43:59 [warn] 1#1: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1
nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1

2025/05/30 11:43:59 [emerg] 1#1: SSL_CTX_use_PrivateKey("/etc/nginx/sannav-cert.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
nginx: [emerg] SSL_CTX_use_PrivateKey("/etc/nginx/sannav-cert.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

已验证 CA 证书和 SANnav 服务器签名证书的通用名称 （CN） 是否相同：

openssl x509 -in /tmp/olsannav.kba.de.crt -noout -subject
subject=O=KBA, OU=146-SSL-Server, OU=SAN, CN=olsannav.kba.de

[VMware ] root@olsannav.kba.de /opt/sannav # hostname
olsannav.kba.de

还验证了证书：

# openssl rsa -noout -modulus -in olsannav.kba.de.key | openssl md5
MD5(stdin)= 3de4b148f281980ec2e9ad827b7ca257

# openssl x509 -noout -modulus -in olsannav.kba.de.crt | openssl md5
MD5(stdin)= 3de4b148f281980ec2e9ad827b7ca257

# openssl verify -CAfile /tmp/ca-chain.crt /tmp/olsannav.kba.de.crt
/tmp/olsannav.kba.de.crt: OK

这些错误表明密钥的值可能不正确，或者在某个时间点受密码保护。在这种情况下，证书的格式错误。 

将证书从 DER 重定向到 PEM 格式化并按照以下说明启动代理服务。

1. 启动 SANnav 服务器的 Linux 控制台。
2. 前往位置 <SANnav_Home>/conf/nginx 并备份文件 sannav-cert.pem 和 sannav-cert.Key 然后将其移出 SANnav 主位置。
3. 验证 原始证书和密钥：
   1. 这两个命令打印证书和密钥的 md5 校验和;可以比较校验和以验证证书和密钥是否匹配：

openssl x509 -noout -modulus -in server.pem | openssl md5

openssl rsa -noout -modulus -in server.key | openssl md5

2. 验证 证书链：

openssl verify -CAfile chain.pem server.pem

3. 验证 密钥：

openssl rsa -check -noout -in server.key

4. 检查证书并返回有关它的信息（签名机构、到期日期等）：

openssl x509 -in server.pem -noout -text
openssl x509 -in chain.pem -noout -text

4. 将正确的证书并链式复制到目标位置 <SANnav_Home>/conf/nginx
   1. 在 <~location original certificates received from the CA> 做：

cat <server_cert.pem> <chained_cert.pem> >> sannav-cert.pem

cat <server_key.key> >> sannav-cert.key

2. 复制 <~location original key>/sannav-cert.key <SANnav_Home>/conf/nginx/sannav-cert.key
3. 复制 <~location original pem>/sannav-cert.pem <SANnav_Home>/conf/nginx/sannav-cert.pem

5. 重新启动 nginx service 按照以下步骤作：
   1. 执行 以下命令以获取代理服务 ID：

[root@sannav4321 bin]# docker service ls | grep proxy
ypaxcuueqlbb   dcm_2_2_0_proxy

replicated   0/1        10.1xx.4x.8x:5000/proxy-local:sann2.2.0        

2. 使用以下命令缩减代理服务：

[root@sannav4321 bin]# docker service scale dcm_2_2_0_proxy=0
ypaxcuueqlbb scaled to 0
overall progress: 0 out of 0 tasks
verify: Service converged

3. 等待 10-15 秒，然后使用以下命令 扩展 代理服务：

[root@sannav4321 bin]# docker service scale dcm_2_2_0_proxy=1
ypaxcuueqlbb scaled to 1
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged

4. 使用以下命令确认代理服务是否已启动并“1/1”运行：

[root@sannav4321 bin]# docker service ls | grep proxy
ypaxcuueqlbb   dcm_2_2_0_proxy                                  replicated   1/1        10.155.43.87:5000/proxy-local:sann2.2.0          
[root@sannav4321 bin]#

6. 验证 SANnav 服务状态，以及 nginx proxy service 使用脚本是否已启动并正在运行 check-sannav-status.sh.
7. 运行 脚本 replace-sannav-certificates 再次在代理启动并应用密钥、证书和链之后，将正确的证书应用于 KAFKA 容器。按照 replace-sannav-certificates 脚本。