Record the process of changing the HTTPS certificate on the platform once

hongkun.feng

Problem details: The customer platform needs to replace the HTTPS certificate due to its expiration. The enterprise certificate purchased from Alibaba Cloud contains a compressed file, which contains two files after decompression: a key file and a PEM file. There are pits during the replacement process, please pay attention to them

Processing procedure:
① The customer's certificate has expired and they need to replace it when purchasing a new HTTPS certificate.
② Upload the certificate file to two management nodes and extract a key file and PEM file.
③ Convert PEM files and key files to pkcs12 format (after entering the command, ask for a password and set your own password)
#openssl pkcs12 -export -in ui.keystore.pem -inkey 8121735__scsz.com.key -out test.p12    （ The files highlighted in red are the actual files after decompression
④ Convert the pkcs12 file to PEM format again (prompt to enter the password set in the previous step) (be sure to perform this step and do not replace it with the built-in PEM file, otherwise it will cause the UI service to fail)
#openssl pkcs12 -in test.p12 -out test.pem -nodes
⑤ Query the converted pkcs12 certificate alias
#/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/bin/keytool -list -v -keystore /root/Keystore_Tomcat/test.p12   
⑥ Custom certificate alias, certificate path, certificate type, private key password, HTTPS login port and other information
zstack-ctl config_ui --enable-ssl True --ssl-keyalias=1 --ssl-keystore=/root/Keystore_Tomcat/test.p12 --ssl-keystore-type=PKCS12 --ssl-keystore-password=password --server-port=5443
⑦ Upload the converted pkcs12 file and PEM file to the default directory
#cp test.p* /usr/local/zstack/zstack-ui/   
⑧ Modify the zstack. properties configuration file to set the certificate path to an absolute path, and then start the management service.
#consoleProxyCertFile = /usr/local/zstack/zstack-ui/test.pem

Problem summary: Decompressing the PEM file and replacing it will cause Nginx service to fail to start, Nginx to fail to start, and UI to fail to start. This should be noted