v2.1.7+Managing TLS/SSL certificates

The certificates used to secure and encrypt communication and verify identity over the network can be managed automatically or manually. You can use scripts to manually rotate customer-provided SSL certificates before they expire.

Overview

To manage the certificates manually, the --sslFolder attribute must be specified when installing the HCL Universal Orchestrator. Then, you must manually update the certificates using scripts before they expire.

To manually rotate user-provided SSL certificates before expiration, you can use the rotateCerts script. Run the script by specifying the path to your new certificates:
./rotateCerts.sh --sslFolder=[path_to_new_certs]
The script automatically validates the new certificate files. If the files are deemed valid, the system archives the current certificates in the .uno/security/backup_[timestamp] directory. The script then copies the new files into the active directory, and the HCL Universal Orchestrator service automatically restarts to implement the new SSL context.
Note: The system performs a daily check and records a WARNING notification in the logs if an externally provided certificate is within 30 days of expiration. The 30 days is the default value that you can configure during installation.
If you omit the --sslFolder attribute during installation, you can follow the interactive prompts to automatically generate self-signed certificates. Complete the following steps, pressing Enter to proceed with the default values where applicable:
  1. Type Y when the script prompts:

    No SSL folder provided. Would you like to automatically generate self-signed certificates for this installation? (Y/N)

  2. Press Enter to accept the default value or specify the expiration period in days when the script prompts:

    Enter the certificate expiration period in days. The default is 365:

  3. Press Enter to accept the default value or specify the renewal lead time in days when the script prompts:

    Enter renewal lead time in days (the certificates rotate when currentTime >= expiryDate - renewBefore). The default is 30:

  4. Press Enter to accept the default value or specify a Common Name (CN) when the script prompts:

    Enter a Common Name (CN) for the Root Certificate Authority (CA). The default is UnO Root CA - (Hostmachine_FQDN):

  5. Type any additional DNS aliases for the Subject Alternative Name (SAN) separated by commas, when the script prompts:

    Enter additional DNS aliases for the Subject Alternative Name (SAN) separated by commas. The default is none:

After you complete these steps, the script automatically generates the Root Certificate Authority (CA), persists the configuration in the database for active-active clustering, and saves the generated files to the .uno/security/certs directory. The system is programmed to automatically rotate the certificates prior to their expiration, which is configurable.
Note: For internally managed certificates, the system automatically rotates certificates 30 days prior to their expiration, based on the renewal lead time configured during installation.