Chapter 6. Renewing and changing the SSL/TLS certificates

Procedure

1. To prepare the certificates and keys, choose one of the following methods:

   • To provide custom certificates - For each service that requires updated TLS certificates, copy the new certificates and keys to a path relative to the Ansible Automation Platform installer. Then update the inventory file variables with the absolute paths to the new files.

     # Platform gateway
     gateway_tls_cert=<path_to_tls_certificate>
     gateway_tls_key=<path_to_tls_key>
     gateway_pg_tls_cert=<path_to_tls_certificate>
     gateway_pg_tls_key=<path_to_tls_key>
     gateway_redis_tls_cert=<path_to_tls_certificate>
     gateway_redis_tls_key=<path_to_tls_key>
     
     # Automation controller
     controller_tls_cert=<path_to_tls_certificate>
     controller_tls_key=<path_to_tls_key>
     controller_pg_tls_cert=<path_to_tls_certificate>
     controller_pg_tls_key=<path_to_tls_key>
     
     # Automation hub
     hub_tls_cert=<path_to_tls_certificate>
     hub_tls_key=<path_to_tls_key>
     hub_pg_tls_cert=<path_to_tls_certificate>
     hub_pg_tls_key=<path_to_tls_key>
     
     # Event-Driven Ansible
     eda_tls_cert=<path_to_tls_certificate>
     eda_tls_key=<path_to_tls_key>
     eda_pg_tls_cert=<path_to_tls_certificate>
     eda_pg_tls_key=<path_to_tls_key>
     eda_redis_tls_cert=<path_to_tls_certificate>
     eda_redis_tls_key=<path_to_tls_key>
     
     # PostgreSQL
     postgresql_tls_cert=<path_to_tls_certificate>
     postgresql_tls_key=<path_to_tls_key>
     
     # Receptor
     receptor_tls_cert=<path_to_tls_certificate>
     receptor_tls_key=<path_to_tls_key>

     Copy to Clipboard Toggle word wrap

   • To generate new certificates - If you want the installation program to generate a new certificate for a service, delete or move the existing certificates and keys.

     Expand

     Table 6.1. Certificate and key file paths per service

     Service	Certificate file path	Key file path
     Automation controller	~/aap/controller/etc/tower.cert	~/aap/controller/etc/tower.key
     Event-Driven Ansible	~/aap/eda/etc/eda.cert	~/aap/eda/etc/eda.key
     Platform gateway	~/aap/gateway/etc/gateway.cert	~/aap/gateway/etc/gateway.key
     Automation hub	~/aap/hub/etc/pulp.cert	~/aap/hub/etc/pulp.key
     PostgreSQL	~/aap/postgresql/server.crt	~/aap/postgresql/server.key
     Receptor	~/aap/receptor/etc/receptor.crt	~/aap/receptor/etc/receptor.key
     Redis	~/aap/redis/server.crt	~/aap/redis/server.key

     Show more

2. After preparing your certificates, run the install playbook from your installation directory:

   ansible-playbook -i <inventory_file_name> ansible.containerized_installer.install

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the signed SSL certificate and key to a secure location.

2. Create a TLS secret within OpenShift:

   oc create secret tls ${CONTROLLER_INSTANCE}-certs-$(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key

   Copy to Clipboard Toggle word wrap

3. Modify the automation controller custom resource to add route_tls_secret and the name of the new secret to the spec section.

   oc edit automationcontroller/${CONTROLLER_INSTANCE}

   Copy to Clipboard Toggle word wrap

   ...
   spec:
     route_tls_secret: automation-controller-certs-2023-04-06
   ...

   Copy to Clipboard Toggle word wrap

1. Wait a few minutes for the changes to be applied.

2. Verify that new SSL certificate and key have been installed:

   true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the signed SSL certificate and key to a secure location.

2. Create a TLS secret within OpenShift:

   oc create secret tls ${AUTOMATION_HUB_INSTANCE}-certs-$(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key

   Copy to Clipboard Toggle word wrap

3. Modify the automation hub custom resource to add route_tls_secret and the name of the new secret to the spec section.

   oc edit automationhub/${AUTOMATION_HUB_INSTANCE}

   Copy to Clipboard Toggle word wrap

   ...
   spec:
     route_tls_secret: automation-hub-certs-2023-04-06
   ...

   Copy to Clipboard Toggle word wrap

1. Wait a few minutes for the changes to be applied.

2. Verify that new SSL certificate and key have been installed:

   true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443

   Copy to Clipboard Toggle word wrap

Procedure

1. Add aap_service_regen_cert=true to the inventory file in the [all:vars] section:

   [all:vars]
   aap_service_regen_cert=true

   Copy to Clipboard Toggle word wrap
2. Run the installer.

Procedure

1. Copy the new SSL/TLS certificates and keys to a path relative to the Ansible Automation Platform installer.

2. Add the absolute paths of the SSL/TLS certificates and keys to the inventory file. Refer to Inventory file variables for guidance on setting these variables.

   • Event-Driven Ansible controller: automationedacontroller_ssl_cert, automationedacontroller_ssl_key, custom_ca_cert
   • Platform gateway: automationgateway_ssl_cert, automationgateway_ssl_key, custom_ca_cert
   • Automation hub: automationhub_ssl_cert, automationhub_ssl_key, custom_ca_cert

   • Automation controller: web_server_ssl_cert, web_server_ssl_key, custom_ca_cert

     Note

     The custom_ca_cert must be the root certificate authority that signed the intermediate certificate authority. This file is installed in /etc/pki/ca-trust/source/anchors.

3. Run the installation program.

Procedure

1. Backup the current SSL/TLS certificate:

   cp <CERT_PATH> <CERT_PATH>-$(date +%F)

   Copy to Clipboard Toggle word wrap

2. Backup the current key files:

   cp <KEY_PATH> <KEY_PATH>-$(date +%F)

   Copy to Clipboard Toggle word wrap
3. Copy the new SSL/TLS certificate to the certificate path.
4. Copy the new key to the key path.

5. Restore the SELinux context:

   restorecon -v <CERT_PATH> <KEY_PATH>

   Copy to Clipboard Toggle word wrap

6. Set appropriate permissions for the certificate and key files:

   chown <OWNER>:<GROUP> <CERT_PATH> <KEY_PATH>
   chmod 0600 <CERT_PATH> <KEY_PATH>

   Copy to Clipboard Toggle word wrap

7. Test the NGINX configuration:

   nginx -t

   Copy to Clipboard Toggle word wrap

8. Reload NGINX:

   systemctl reload nginx.service

   Copy to Clipboard Toggle word wrap

9. Verify that new SSL/TLS certificate and key have been installed:

   true | openssl s_client -showcerts -connect <COMPONENT_FQDN>:443

   Copy to Clipboard Toggle word wrap
   Expand

   Table 6.2. SSL/TLS certificate and key file paths per service

   Service	Certificate file path	Key file path	Owner:Group
   Automation controller	/etc/tower/tower.cert	/etc/tower/tower.key	root:awx
   Automation hub	/etc/pulp/certs/pulp_webserver.crt	/etc/pulp/certs/pulp_webserver.key	root:pulp
   Event-Driven Ansible controller	/etc/ansible-automation-platform/eda/server.cert	/etc/ansible-automation-platform/eda/server.key	root:eda
   Platform gateway	/etc/ansible-automation-platform/gateway/gateway.cert	/etc/ansible-automation-platform/gateway/gateway.key	root:gateway

   Show more