How to update SSL Certificates

On the Elastic Load Balancer

1. Add the new certificates to the elastic load balancer.
2. Replace the Certificates for Web(443), IDM (1443)(one-way) and NM(9443).

On the EC2 Linux Instances

1. Copy or move the current certificates to give them a different name in the same location
   
• /bin/mv /opt/usher/ssl/server.crt /opt/usher/ssl/server_old.crt
• /bin/mv /opt/usher/ssl/server.key /opt/usher/ssl/server_old.key
• /bin/mv /opt/usher/ssl/intermediate.crt /opt/usher/ssl/intermediate_old.crt
• /bin/mv /opt/usher/ssl/serverca.pem /opt/usher/ssl/serverca_old.pem
2. Add the new certificates to the ec2 instances in the same location
   
• vi /opt/usher/ssl/server.crt , opt/usher/ssl/server.key, opt/usher/ssl/intermediate.crt (Add certificate information here.)
• cat server.crt server.key intermediate.crt self-server.crt >> serverca.pem
• /bin/chown -R mstr:mstr /opt/usher/ssl
3. Add the saml2.crt for IDM
   
• /bin/mv /opt/usher/usherserver/usherApps/shardIDM/webapps/files/saml2.crt /opt/usher/usherserver/usherApps/shardIDM/webapps/files/saml2_bak.crt
• /bin/mv /opt/usher/usherserver/usherApps/shardIDM/tomcat/webapps/files/saml2.crt /opt/usher/usherserver/usherApps/shardIDM/tomcat/webapps/files/saml2_bak.crt
• /bin/cp /opt/usher/ssl/server.crt /opt/usher/usherserver/usherApps/shardIDM/webapps/files/saml2.crt
• /bin/cp /opt/usher/ssl/server.crt /opt/usher/usherserver/usherApps/shardIDM/tomcat/webapps/files/saml2.crt
• /bin/chown -R mstr:mstr /opt/usher/usherserver/usherApps/shardIDM/webapps/files/saml2.crt
• /bin/chown -R mstr:mstr /opt/usher/usherserver/usherApps/shardIDM/tomcat/webapps/files/saml2.crt
4. For the network manager to display the warning that the certificates for different connectors (Salesforce etc.) are about to expire, make the following changes to the databases.
   
1. Log in into the mysql databases.
2. Use usher_server.
3. Update configuration set configure = '{"old_key_path":"/opt/usher/ssl/server_old.key"}', updated_ts = now() where name = 'resp_sign_key_path' and type = 'saml'.
4. Update configuration set configure = '{"old_cert_path":"/opt/usher/ssl/server_old.crt"}', updated_ts = now() where name = 'verify_cert_path' and type = 'saml'.
5. Restart the IDM and Gateway services
   
• su - mstr -c "/opt/usher/usherserver/usherApps/shardIDM/bin/tomcat.sh restart
• su - mstr -c "/opt/usher/usherserver/usherApps/shardGateway/bin/tomcat.sh restart

KB425782