Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

Chapter 8. Renewing and changing the SSL certificate

If your current SSL certificate has expired or will expire soon, you can either renew or replace the SSL certificate used by Ansible Automation Platform.

You must renew the SSL certificate if you need to regenerate the SSL certificate with new information such as new hosts.

You must replace the SSL certificate if you want to use an SSL certificate signed by an internal certificate authority.

8.1. Renewing the self-signed SSL certificate
링크 복사

The following steps regenerate a new SSL certificate for both automation controller and automation hub.

Procedure

  1. Add aap_service_regen_cert=true to the inventory file in the [all:vars] section: 

    [all:vars]
aap_service_regen_cert=true
    Copy to Clipboard Toggle word wrap
  2. Run the installer.

8.2. Changing SSL certificates
링크 복사

To change the SSL certificate, you can edit the inventory file and run the installer. The installer verifies that all Ansible Automation Platform components are working. The installer can take a long time to run.

Alternatively, you can change the SSL certificates manually. This is quicker, but there is no automatic verification.

8.2.1. Prerequisites
링크 복사

  • If there is an intermediate certificate authority, you must append it to the server certificate.
  • Both automation controller and automation hub use NGINX so the server certificate must be in PEM format.
  • Use the correct order for the certificates: The server certificate comes first, followed by the intermediate certificate authority.

For further information, see the ssl certificate section of the NGINX documentation.

8.2.2. Changing the SSL certificate and key using the installer
링크 복사

The following procedure describes how to change the SSL certificate and key in the inventory file.

Procedure

  1. Copy the new SSL certificates and keys to a path relative to the Ansible Automation Platform installer.

  2. Add the absolute paths of the SSL certificates and keys to the inventory file. Refer to the Automation controller variables and Automation hub variables sections of the Red Hat Ansible Automation Platform Installation Guide for guidance on setting these variables.

    • Automation controller: web_server_ssl_cert, web_server_ssl_key, custom_ca_cert
    • Automation hub: automationhub_ssl_cert, automationhub_ssl_key, custom_ca_cert
    Note

    The custom_ca_cert must be the root certificate authority that signed the intermediate certificate authority. This file is installed in /etc/pki/ca-trust/source/anchors.

  3. Run the installer.

8.2.3. Changing the SSL certificate manually
링크 복사

8.2.3.1. Changing the SSL certificate and key manually on automation controller
링크 복사

The following procedure describes how to change the SSL certificate and key manually on Automation Controller.

Procedure

  1. Backup the current SSL certificate: 

    cp /etc/tower/tower.cert /etc/tower/tower.cert-$(date +%F)
    Copy to Clipboard Toggle word wrap

  2. Backup the current key files: 

    cp /etc/tower/tower.key /etc/tower/tower.key-$(date +%F)+
    Copy to Clipboard Toggle word wrap
  3. Copy the new SSL certificate to /etc/tower/tower.cert.
  4. Copy the new key to /etc/tower/tower.key.

  5. Restore the SELinux context: 

    restorecon -v /etc/tower/tower.cert /etc/tower/tower.key
    Copy to Clipboard Toggle word wrap

  6. Set appropriate permissions for the certificate and key files: 

    chown root:awx /etc/tower/tower.cert /etc/tower/tower.key
chmod 0600 /etc/tower/tower.cert /etc/tower/tower.key
    Copy to Clipboard Toggle word wrap

  7. Test the NGINX configuration: 

    nginx -t
    Copy to Clipboard Toggle word wrap

  8. Reload NGINX: 

    systemctl reload nginx.service
    Copy to Clipboard Toggle word wrap

  9. Verify that new SSL certificate and key have been installed: 

    true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443
    Copy to Clipboard Toggle word wrap

The following procedure describes how to change the SSL certificate and key for automation controller running on OpenShift Container Platform.

Procedure

  1. Copy the signed SSL certificate and key to a secure location.

  2. Create a TLS secret within OpenShift: 

    oc create secret tls ${CONTROLLER_INSTANCE}-certs-$(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key
    Copy to Clipboard Toggle word wrap

  3. Modify the automation controller custom resource to add route_tls_secret and the name of the new secret to the spec section. 

    oc edit automationcontroller/${CONTROLLER_INSTANCE}
    Copy to Clipboard Toggle word wrap 
    ...
spec:
  route_tls_secret: automation-controller-certs-2023-04-06
...
    Copy to Clipboard Toggle word wrap

The name of the TLS secret is arbitrary. In this example, it is timestamped with the date that the secret is created, to differentiate it from other TLS secrets applied to the automation controller instance.

  1. Wait a few minutes for the changes to be applied.

  2. Verify that new SSL certificate and key have been installed: 

    true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443
    Copy to Clipboard Toggle word wrap

8.2.3.3. Changing the SSL certificate and key manually on automation hub
링크 복사

The following procedure describes how to change the SSL certificate and key manually on automation hub.

Procedure

  1. Backup the current SSL certificate: 

    cp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.crt-$(date +%F)
    Copy to Clipboard Toggle word wrap

  2. Backup the current key files: 

    cp /etc/pulp/certs/pulp_webserver.key /etc/pulp/certs/pulp_webserver.key-$(date +%F)
    Copy to Clipboard Toggle word wrap
  3. Copy the new SSL certificate to /etc/pulp/certs/pulp_webserver.crt.
  4. Copy the new key to /etc/pulp/certs/pulp_webserver.key.

  5. Restore the SELinux context: 

    restorecon -v /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
    Copy to Clipboard Toggle word wrap

  6. Set appropriate permissions for the certificate and key files: 

    chown root:pulp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
    Copy to Clipboard Toggle word wrap 
    chmod 0600 /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
    Copy to Clipboard Toggle word wrap

  7. Test the NGINX configuration: 

    nginx -t
    Copy to Clipboard Toggle word wrap

  8. Reload NGINX: 

    systemctl reload nginx.service
    Copy to Clipboard Toggle word wrap

  9. Verify that new SSL certificate and key have been installed: 

    true | openssl s_client -showcerts -connect ${CONTROLLER_FQDN}:443
    Copy to Clipboard Toggle word wrap
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat