Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

16.3. Renewing Subsystem Certificates

There are two methods of renewing a certificate. Regenerating the certificate takes its original key and its original profile and request, and recreates an identical key with a new validity period and expiration date. Re-keying a certificate resubmits the initial certificate request to the original profile, but generates a new key pair. Administrator certificates can be renewed by being re-keyed.

16.3.1. Re-keying Certificates in the End-Entities Forms
Copiar enlace

Subsystem certificates can be renewed directly in the end user enrollment forms, using the serial number of the original certificate.
  1. Renew the certificates in the CA's end-entities forms, as described in Section 5.5, “Renewing Certificates”. This requires the serial number of the subsystem certificate being renewed.
  2. Import the certificate into the subsystem's database, as described in Section 16.6.1, “Installing Certificates in the Certificate System Database”. The certificate can be imported using certutil or the console. For example: 
    certutil -A -n "ServerCert cert-example" -t u,u,u -d /var/lib/pki/instance_name/alias -a -i /tmp/example.cert
    Copy to Clipboard Toggle word wrap

16.3.2. Renewing Certificates in the Console
Copiar enlace

The Java subsystems can renew any of their subsystem certificates through their administrative console. The process is exactly the same as requesting new subsystem certificates (Section 16.2, “Requesting Certificates through the Console”), with one crucial difference: renewal uses an existing key pair rather than generating a new one.
Renewing Subsystem Certificate
View larger image
Renewing Subsystem Certificate

Figure 16.1. Renewing Subsystem Certificate

After renewing a certificate, then delete the original certificate from the database (Section 16.6.3, “Deleting Certificates from the Database”).

16.3.3. Renewing Certificates Using certutil
Copiar enlace

certutil can be used to generate a certificate request using an existing key pair in the certificate database. The new certificate request can then be submitted through the regular profile pages for the CA to issue a renewed certificate.

Note

Encryption and signing certificates are created in a single step. However, the renewal process only renews one certificate at a time.
To renew both certificates in a certificate pair, each one has to be renewed individually.
  1. Get the password for the token database. 
    cat /var/lib/pki/instance_name/conf/password.conf

internal=263163888660
    Copy to Clipboard Toggle word wrap
  2. Open the certificate database directory of the instance whose certificate is being renewed. 
    cd /var/lib/pki/instance_name/alias
    Copy to Clipboard Toggle word wrap
  3. List the key and nickname for the certificate being renewed. In order to renew a certificate, the key pairs used to generate and the subject name given to the new certificate must be the same as the one in the old certificate. 
    # certutil -K -d .

certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> rsa      69481646e38a6154dc105960aa24ccf61309d37d   caSigningCert cert-pki-tomcat CA
    Copy to Clipboard Toggle word wrap
  4. Copy the alias directory as a backup, then delete the original certificate from the certificate database. For example: 
    certutil -D -n "ServerCert cert-example"  -d .
    Copy to Clipboard Toggle word wrap
  5. Run the certutil command with the options set to the values in the existing certificate. 
    certutil -d . -R -n "NSS Certificate DB:cert-pki-tomcat CA" -s "cn=CA Authority,o=Example Domain" -a -o example.req2.txt
    Copy to Clipboard Toggle word wrap
    The difference between generating a new certificate and key pair and renewing the certificate is the value of the -n option. To generate an entirely new request and key pair, then -k sets the key type and is used with -g, which sets the bit length. For a renewal request, the -n option uses the certificate nickname to access the existing key pair stored in the security database.
    For further details about the parameters, see the certutil(1) man page.
  6. Submit the certificate request and then retrieve it and install it, as described in Section 5.4, “Requesting and Receiving Certificates”.

16.3.4. Renewing System Certificates
Copiar enlace

Certificate System does not automatically renew system certificates online while the PKI server is running. However, if a system certificate expires, Certificate System will fail to start.
To renew system certificates:
  1. If the system certificate is expired:
    1. Create a temporary certificate: 
      # pki-server cert-create sslserver --temp
      Copy to Clipboard Toggle word wrap
    2. Import the temporary certificate into Certificate System's Network Security Services (NSS) database: 
      # pki-server cert-import sslserver
      Copy to Clipboard Toggle word wrap
    3. Start Certificate System: 
      # systemctl start pki-tomcatd@instance_name.service
      Copy to Clipboard Toggle word wrap
  2. Display the certificates and note the ID of the expired system certificate: 
    # pki-server cert-find
    Copy to Clipboard Toggle word wrap
  3. Create the new permanent certificate: 
    # pki-server cert-create certificate_ID
    Copy to Clipboard Toggle word wrap
  4. Stop Certificate System: 
    # systemctl stop pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
  5. Import the new certificate to replace the expired certificate: 
    # pki-server cert-import certificate_ID
    Copy to Clipboard Toggle word wrap
  6. Start Certificate System: 
    # systemctl start pki-tomcatd@instance_name.service
    Copy to Clipboard Toggle word wrap
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat