Appendix E. Red Hat Virtualization and encrypted communication

Procedure

1. Back up the current apache.p12 file:

   # cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck

2. Replace the current file with the new file:

   # cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12

3. Extract the private key and certificate to the required locations:

   # openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key
   # openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer

   If the file is password protected, add -passin pass:password to the command, replacing password with the required password.

Procedure

1. If you are using a self-hosted engine, put the environment into global maintenance mode.

   # hosted-engine --set-maintenance --mode=global

   For more information, see Maintaining the Self-Hosted Engine.

2. Add your CA certificate to the host-wide trust store:

   # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors
   # update-ca-trust

3. The Manager has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link:

   # rm /etc/pki/ovirt-engine/apache-ca.pem

4. Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem:

   # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem

5. Back up the existing private key and certificate:

   # cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck
   # cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck

6. Copy the private key to the required location:

   # cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass

7. Set the private key owner to root and set the permissions to 0640:

   # chown root:ovirt  /etc/pki/ovirt-engine/keys/apache.key.nopass
   # chmod 640 /etc/pki/ovirt-engine/keys/apache.key.nopass

8. Copy the certificate to the required location:

   # cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer

9. Set the certificate owner to root and set the permissions to 0644:

   # chown root:ovirt /etc/pki/ovirt-engine/certs/apache.cer
   # chmod 644 /etc/pki/ovirt-engine/certs/apache.cer

10. Restart the Apache server:

    # systemctl restart httpd.service

11. Create a new trust store configuration file, /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf, with the following parameters:

    ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
    ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""

12. Copy the /etc/ovirt-engine/ovirt-websocket-proxy.conf.d/10-setup.conf file, and rename it with an index number that is greater than 10 (for example, 99-setup.conf). Add the following parameters to the new file:

    SSL_CERTIFICATE=/etc/pki/ovirt-engine/certs/apache.cer
    SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass

13. Restart the websocket-proxy service:

    # systemctl restart ovirt-websocket-proxy.service

14. If you manually changed the /etc/ovirt-provider-ovn/conf.d/10-setup-ovirt-provider-ovn.conf file, or are using a configuration file from an older installation, make sure that the Manager is still configured to use /etc/pki/ovirt-engine/apache-ca.pem as the certificate source.

15. Create the /etc/ovirt-engine-backup/engine-backup-config.d directory:

    # mkdir -p /etc/ovirt-engine-backup/engine-backup-config.d

16. Create the /etc/ovirt-engine-backup/engine-backup-config.d/update-system-wide-pki.sh file with the following content. This enables ovirt-engine-backup to automatically update the system on restore.

    BACKUP_PATHS="${BACKUP_PATHS}
    /etc/ovirt-engine-backup"
    cp -f /etc/pki/ovirt-engine/apache-ca.pem \
      /etc/pki/ca-trust/source/anchors/3rd-party-ca-cert.pem
    update-ca-trust

17. Restart the ovirt-provider-ovn service:

    # systemctl restart ovirt-provider-ovn.service

18. Restart the ovirt-imageio service:

    # systemctl restart ovirt-imageio.service

19. Restart the ovirt-engine service:

    # systemctl restart ovirt-engine.service

20. If you are using a self-hosted engine, turn off global maintenance mode:

    # hosted-engine --set-maintenance --mode=none