Connectrix SANnav：將 SSL 憑證更換為 CA 簽署後，代理服務未啟動

[VMware] root@olsannav.kba.de /opt/sannav/Portal_2.4.0_bld249/bin # sh ./replace-sannav-certificates.sh

Enter the path for the chained CA certificate including the file name (If you have an intermediate certificate chain the same with root and provide the path including file name.) :
/tmp/ca-chain.crt

Enter the path for the private key including the file name :
/tmp/olsannav.kba.de.key

Enter the password for private key (/tmp/olsannav.kba.de.key). If the private key is not password protected, press Enter :

Enter the path for the SSL certificate to be installed on olsannav.kba.de including the file name. Ensure that the Common Name of the certificate matches the FQDN of the host olsannav.kba.de.
/tmp/olsannav.kba.de.crt
No extensions in certificate

Successfully validated the certificate and the private key.
Stopping the SANnav Management Portal server to apply the certificates.
Stopped the SANnav Management Portal server to apply the certificates.
Starting SANnav Management Portal services.
Services have been started.
Waiting and checking for SANnav server to be ready. This may take a few minutes.
[|]
Some services are still not up. Run the script (/opt/sannav/Portal_2.4.0_bld249/bin/check-sannav-status.sh) to check SANnav startup status.
If all services are not up after an additional 15 minutes, run the troubleshooting script (/opt/sannav/Portal_2.4.0_bld249/bin/troubleshooting-sannav.sh) to resolve any reported issues and restart SANnav.

代理服務的 Docker 容器顯示以下錯誤：

/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up

2025/05/30 11:43:59 [warn] 1#1: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1
nginx: [warn] the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1

2025/05/30 11:43:59 [emerg] 1#1: SSL_CTX_use_PrivateKey("/etc/nginx/sannav-cert.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
nginx: [emerg] SSL_CTX_use_PrivateKey("/etc/nginx/sannav-cert.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

已驗證 CA 憑證和 SANnav 伺服器簽署憑證的通用名稱 （CN） 是否相同：

openssl x509 -in /tmp/olsannav.kba.de.crt -noout -subject
subject=O=KBA, OU=146-SSL-Server, OU=SAN, CN=olsannav.kba.de

[VMware ] root@olsannav.kba.de /opt/sannav # hostname
olsannav.kba.de

還驗證了憑證：

# openssl rsa -noout -modulus -in olsannav.kba.de.key | openssl md5
MD5(stdin)= 3de4b148f281980ec2e9ad827b7ca257

# openssl x509 -noout -modulus -in olsannav.kba.de.crt | openssl md5
MD5(stdin)= 3de4b148f281980ec2e9ad827b7ca257

# openssl verify -CAfile /tmp/ca-chain.crt /tmp/olsannav.kba.de.crt
/tmp/olsannav.kba.de.crt: OK

這些錯誤表明金鑰可能具有不正確的值或在某些時候已受密碼保護。在這種情況下，證書格式錯誤。 

將憑證從 DER 的輸出傳送至 PEM 設定格式並依照下列指示來啟動 Proxy 服務。

1. 啟動 Linux 主控台至 SANnav 伺服器。
2. 前往該位置 <SANnav_Home>/conf/nginx 並備份檔案 sannav-cert.pem 和 sannav-cert.Key 並將其移出 SANnav 原廠位置
3. 驗證 原始憑證和金鑰：
   1. 這兩個命令列印證書和金鑰的 md5 校驗和;可以比較檢查總和以驗證憑證和金鑰是否匹配：

openssl x509 -noout -modulus -in server.pem | openssl md5

openssl rsa -noout -modulus -in server.key | openssl md5

2. 驗證 憑證鏈結：

openssl verify -CAfile chain.pem server.pem

3. 驗證 金鑰：

openssl rsa -check -noout -in server.key

4. 檢查憑證並傳回相關資訊 （簽署授權單位、到期日期等）：

openssl x509 -in server.pem -noout -text
openssl x509 -in chain.pem -noout -text

4. 將正確的憑證和鏈結複製到位置 <SANnav_Home>/conf/nginx
   1. 在 <~location original certificates received from the CA> 做：

cat <server_cert.pem> <chained_cert.pem> >> sannav-cert.pem

cat <server_key.key> >> sannav-cert.key

2. 複製 <~location original key>/sannav-cert.key <SANnav_Home>/conf/nginx/sannav-cert.key
3. 複製 <~location original pem>/sannav-cert.pem <SANnav_Home>/conf/nginx/sannav-cert.pem

5. 重新啟動 nginx service 請遵循以下步驟：
   1. 執行 以下命令以取得代理服務 ID：

[root@sannav4321 bin]# docker service ls | grep proxy
ypaxcuueqlbb   dcm_2_2_0_proxy

replicated   0/1        10.1xx.4x.8x:5000/proxy-local:sann2.2.0        

2. 使用以下命令縮減代理服務：

[root@sannav4321 bin]# docker service scale dcm_2_2_0_proxy=0
ypaxcuueqlbb scaled to 0
overall progress: 0 out of 0 tasks
verify: Service converged

3. 等待 10-15 秒，然後使用以下命令 垂直擴充 代理服務：

[root@sannav4321 bin]# docker service scale dcm_2_2_0_proxy=1
ypaxcuueqlbb scaled to 1
overall progress: 1 out of 1 tasks
1/1: running   [==================================================>]
verify: Service converged

4. 使用以下命令確認代理服務是否已啟動並執行「1/1」：

[root@sannav4321 bin]# docker service ls | grep proxy
ypaxcuueqlbb   dcm_2_2_0_proxy                                  replicated   1/1        10.155.43.87:5000/proxy-local:sann2.2.0          
[root@sannav4321 bin]#

6. 驗證 SANnav 服務狀態，無論 nginx proxy service 使用指令檔是否啟動並執行 check-sannav-status.sh.
7. 執行 指令檔 replace-sannav-certificates 在代理啟動后再次應用金鑰、證書和鏈，以將正確的證書應用於 KAFKA 容器。按照 replace-sannav-certificates 腳本。