Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 1540 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ACC 1.401 - SSL Certificate Expired

drees
Apparently the SSL Certificate for ACC 1.401 expired at the end of 2008.  Any idea on how to create a new one?

Can't upgrade to ACC 1.9 - we still have Astaro 6.314 machines running in production.


This thread was automatically locked due to age.
Parents
  • 0
    Hi,

    we'll look into this and keep you posted.

    Cheers,
    Henning
  • 0 in reply to megaposer
    Hello,

    here is some piece of code you can execute directly on your legacy ACC.

    Just copy the stuff via SCP and store it in a location convenient for you and then call it, e.g.

    acc:/root # sh script.sh

    Fill in the requested values.

    Then restart the Frontend:

    acc:/root # /etc/init.d/httpd stop

    ... wait some seconds

    acc:/root # /etc/init.d/httpd start

    Please note: The certificate will be self-signed.

    Cheers,
    Henning

    SSL_DIR=${1:-"/etc/cm/ssl"}
    CERT_FILE="$SSL_DIR/SSL_CERT_WebFrontend.pem"
    KEY_FILE="$SSL_DIR/SSL_KEY_WebFrontend.pem"
    EXPIRATION=365

    openssl genrsa -out $KEY_FILE 1024 && \
    openssl req -new -key $KEY_FILE -x509 -days $EXPIRATION -out $CERT_FILE.crs && \
    openssl x509 -in $CERT_FILE.crs -out $CERT_FILE -signkey $KEY_FILE && \
    rm -rf $CERT_FILE.crs
Reply
  • 0 in reply to megaposer
    Hello,

    here is some piece of code you can execute directly on your legacy ACC.

    Just copy the stuff via SCP and store it in a location convenient for you and then call it, e.g.

    acc:/root # sh script.sh

    Fill in the requested values.

    Then restart the Frontend:

    acc:/root # /etc/init.d/httpd stop

    ... wait some seconds

    acc:/root # /etc/init.d/httpd start

    Please note: The certificate will be self-signed.

    Cheers,
    Henning

    SSL_DIR=${1:-"/etc/cm/ssl"}
    CERT_FILE="$SSL_DIR/SSL_CERT_WebFrontend.pem"
    KEY_FILE="$SSL_DIR/SSL_KEY_WebFrontend.pem"
    EXPIRATION=365

    openssl genrsa -out $KEY_FILE 1024 && \
    openssl req -new -key $KEY_FILE -x509 -days $EXPIRATION -out $CERT_FILE.crs && \
    openssl x509 -in $CERT_FILE.crs -out $CERT_FILE -signkey $KEY_FILE && \
    rm -rf $CERT_FILE.crs
Children
  • 0 in reply to megaposer
    Had to tweak the script.  Yours always generated a certificate with an expiry date of 30 days instead of the specified date.  I also bumped the expiration up to 10 years, don't want to have to worry about this again. [:)] 

    #!/bin/sh

    SSL_DIR=${1:-"/etc/cm/ssl"}

    CERT_FILE="$SSL_DIR/SSL_CERT_WebFrontend.pem"

    KEY_FILE="$SSL_DIR/SSL_KEY_WebFrontend.pem"

    EXPIRATION=3650

    

    openssl genrsa -out $KEY_FILE 1024 && \

    openssl req -new -key $KEY_FILE -x509 -out $CERT_FILE.crs && \

    openssl x509 -days $EXPIRATION -in $CERT_FILE.crs -out $CERT_FILE -signkey $KEY_FILE && \

    rm -rf $CERT_FILE.crs
  • 0 in reply to drees
    *cough*

    Gee, thanks for pointing this out ;-)
Unfiltered HTML