PowerScale OneFS Web Administration Guide

Renew the self-signed TLS certificate

This procedure describes how to replace an expired self-signed TLS certificate by generating a new certificate that is based on the existing (stock) server key.

When you generate a self-signed certificate, you must provide information about your organization. It is a good idea to determine this information in advance, before you begin the process. See the TLS certificate data example section of this chapter for details and examples of the required information.

NOTE This procedure requires you to restart the isi_webui service, which restarts the web administration interface. Therefore, it is recommended that you perform these steps during a scheduled maintenance window.

Open a secure shell (SSH) connection to any node in the cluster and log in as root.
Create a backup directory by running the following command:
```
mkdir /ifs/data/backup/
```
Set the permissions on the backup directory to 700:
```
chmod 700 /ifs/data/backup
```
Make backup copies of the existing server.crt and server.key files by using the cp command to copy them to the backup directory that you just created.

NOTE If files with the same names exist in the backup directory, either overwrite the existing files, or, to save the old backups, rename the new files with a timestamp or other identifier.
Create a working directory to hold the files while you complete this procedure:
```
mkdir /ifs/local/
```
Set the permissions on the working directory to 700:
```
chmod 700 /ifs/local
```
Change to the working directory:
```
cd /ifs/local/
```
At the command prompt, use the cp command to copy the existing certificate to the working directory that you just created, then run the following command to create a certificate that will expire in 2 years (730 days). Increase or decrease the value for -days to generate a certificate with a different expiration date.
```
openssl req -new -days 730 -nodes -x509 -key \
server.key -out server.crt
```
NOTE the -x509 value is a certificate format.
When prompted, type the information to be incorporated into the certificate request.
When you finish entering the information, a renewal certificate is created, based on the existing (stock) server key. The renewal certificate is named server.crt and it appears in the /ifs/local directory.
Optional: To verify the attributes in the TLS certificate, run the following command:
```
isi certificate server view server.crt
```
Run the following commands to install the certificate and key and restart the isi_webui service:
```
isi services -a isi_webui disable 
```
```
chmod 640 server.key 
```
```
# isi certificate server import --name=server –certificate-path=/ifs/server.crt --certificate-key-path=/ifs/server.key
```
```
isi services -a isi_webui enable 
```
If the private key is password encrypted, you can use the isi certificate server import command's --certificate-key-password <string> parameter to specify the password.
Run the command isi certificate server list to verify that the installation succeeded. Optionally re-run the isi certificate server view server.crt command to confirm the certificate settings.

Delete the temporary working files from the /ifs/local directory:

rm /ifs/local/<common-name>.csr \
/ifs/local/<common-name>.key /ifs/local/<common-name>.crt

(Optional) Delete the backup files from the /ifs/data/backup directory:
```
rm /ifs/data/backup/server.crt.bak \
/ifs/data/backup/server.key.bak
```

Welcome

Welcome to Dell

PowerScale OneFS Web Administration Guide

Renew the self-signed TLS certificate

Rate this content