Appendix D. Red Hat Virtualization and Encrypted Communication

Back up the current apache.p12 file:

# cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck

Replace the current file with the new file:

# cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12

Extract the private key and certificate to the required locations. If the file is password protected, you must add -passin pass:_password_, replacing password with the required password.

# openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key
# openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer

If you are using a self-hosted engine, put the environment into global maintenance mode.

# hosted-engine --set-maintenance --mode=global

For more information, see Section 15.1, “Maintaining the Self-Hosted Engine”.

Add your CA certificate to the host-wide trust store:

# cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors
# update-ca-trust

The Manager has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link:

# rm /etc/pki/ovirt-engine/apache-ca.pem

Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem:

# cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem

Back up the existing private key and certificate:

# cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck
# cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck

Copy the private key to the required location:

# cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass

Set the private key owner to root and set the permissions to 0640:

# chown root:ovirt  /etc/pki/ovirt-engine/keys/apache.key.nopass
# chmod 640 /etc/pki/ovirt-engine/keys/apache.key.nopass

Copy the certificate to the required location:

# cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer

Restart the Apache server:

# systemctl restart httpd.service

Create a new trust store configuration file, /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf, with the following parameters:

ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""

Copy the /etc/ovirt-engine/ovirt-websocket-proxy.conf.d/10-setup.conf file, and rename it with an index number that is greater than 10 (for example, 99-setup.conf). Add the following parameters to the new file:

SSL_CERTIFICATE=/etc/pki/ovirt-engine/certs/apache.cer
SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass

Restart the websocket-proxy service:

# systemctl restart ovirt-websocket-proxy.service

Enable engine-backup to update the system on restore by creating a new file, /etc/ovirt-engine-backup/engine-backup-config.d/update-system-wide-pki.sh, with the following content:

BACKUP_PATHS="${BACKUP_PATHS}
/etc/ovirt-engine-backup"
cp -f /etc/pki/ovirt-engine/apache-ca.pem
/etc/pki/ca-trust/source/anchors/3rd-party-ca-cert.pem
update-ca-trust

Restart the ovirt-provider-ovn service:

# systemctl restart ovirt-provider-ovn.service

Restart the ovirt-engine service:

# systemctl restart ovirt-engine.service

If you are using a self-hosted engine, turn off global maintenance mode.

# hosted-engine --set-maintenance --mode=none