第 6 章 续订和更改 SSL/TLS 证书

流程

1. 要准备证书和密钥，请选择以下方法之一：

   • 要提供自定义证书 - 对于需要更新的 TLS 证书的每个服务，请将新证书和密钥复制到相对于 Ansible Automation Platform 安装程序的路径。然后，使用新文件的绝对路径更新清单文件变量。

     # Platform gateway
     gateway_tls_cert=<path_to_tls_certificate>
     gateway_tls_key=<path_to_tls_key>
     gateway_pg_tls_cert=<path_to_tls_certificate>
     gateway_pg_tls_key=<path_to_tls_key>
     gateway_redis_tls_cert=<path_to_tls_certificate>
     gateway_redis_tls_key=<path_to_tls_key>
     
     # Automation controller
     controller_tls_cert=<path_to_tls_certificate>
     controller_tls_key=<path_to_tls_key>
     controller_pg_tls_cert=<path_to_tls_certificate>
     controller_pg_tls_key=<path_to_tls_key>
     
     # Automation hub
     hub_tls_cert=<path_to_tls_certificate>
     hub_tls_key=<path_to_tls_key>
     hub_pg_tls_cert=<path_to_tls_certificate>
     hub_pg_tls_key=<path_to_tls_key>
     
     # Event-Driven Ansible
     eda_tls_cert=<path_to_tls_certificate>
     eda_tls_key=<path_to_tls_key>
     eda_pg_tls_cert=<path_to_tls_certificate>
     eda_pg_tls_key=<path_to_tls_key>
     eda_redis_tls_cert=<path_to_tls_certificate>
     eda_redis_tls_key=<path_to_tls_key>
     
     # PostgreSQL
     postgresql_tls_cert=<path_to_tls_certificate>
     postgresql_tls_key=<path_to_tls_key>
     
     # Receptor
     receptor_tls_cert=<path_to_tls_certificate>
     receptor_tls_key=<path_to_tls_key>

     Copy to Clipboard Toggle word wrap

   • 要生成新的证书 - 如果您希望安装程序为服务生成新证书，请删除或移动现有证书和密钥。

     Expand

     表 6.1. 每个服务的证书和密钥文件路径

     服务	证书文件路径	密钥文件路径
     自动化控制器	~/aap/controller/etc/tower.cert	~/aap/controller/etc/tower.key
     Event-Driven Ansible	~/aap/eda/etc/eda.cert	~/aap/eda/etc/eda.key
     平台网关	~/aap/gateway/etc/gateway.cert	~/aap/gateway/etc/gateway.key
     Automation hub	~/aap/hub/etc/pulp.cert	~/aap/hub/etc/pulp.key
     PostgreSQL	~/aap/postgresql/server.crt	~/aap/postgresql/server.key
     Receptor	~/aap/receptor/etc/receptor.crt	~/aap/receptor/etc/receptor.key
     Redis	~/aap/redis/server.crt	~/aap/redis/server.key

     Show more

2. 准备证书后，从 安装 目录中运行安装 playbook：

   ansible-playbook -i <inventory_file_name> ansible.containerized_installer.install

   Copy to Clipboard Toggle word wrap