Dell SmartFabric OS10 User Guide Release 10.5.4

Updating HTTP certificates

This section describes the procedure to update the HTTP certificates.

To extend the validity period of self-signed certificate, perform the following steps:

1. Use the crypto cert generate command to create a self-signed certificate with a validity period of maximum 10 years.

   OS10# crypto cert generate self-signed
   You are about to be asked to enter information that will be incorporated into
   your certificate request. What you are about to enter is what is called a
   Distinguished Name or a DN. There are quite a few fields but you can leave
   some blank. For some fields there will be a default value.
   
   Certificate file name (home://{filename}, usb://{filename}) : home://Dell.pem
   Key file name (home://{filename}, usb://{filename}, private) [private]: home://Dell.key
   Common Name (eg, FQDN): www.dell.com
   Subject Alternative Name (e.g. IP:A.B.C.D or DNS:domain.name): 192.168.2.38
   Email Address: support@dell.com
   Organization Name (eg, company): DELL
   Organizational Unit Name (eg, section): DELL
   Locality Name (eg, city): Austin
   State or Province Name (full name): TX
   Country Name (2 letter code): US
   Key Length, 512-4096 [2048]: 2048
   Certificate validity in days, 1-10000 [3650]: 3650
   Processing file ...
   Successfully created certificate file and key 
   
   

2. Install the self-signed certificate that you have created using the crypto cert install command.

   OS10# crypto cert install cert-file home://Dell.pem key-file home://Dell.key
   Processing file ...
   Certificate and keys were successfully installed as "Dell.crt" that may be used in a security profile. CN = 100.104.54.76/O=DELL/OU=DELL/L=CHENNAI/ST=TAMILNADU
   

3. Login into Linux shell and link the newly installed certificate and key.

   OS10# system "sudo -i"
   [sudo] password for admin:
   root@OS10:~# cd /etc/nginx/ssl/
   root@OS10:/etc/nginx/ssl# ls
   dhparam.pem  nginx-selfsigned.crt  nginx-selfsigned.key
   root@OS10:/etc/nginx/ssl# cp nginx-selfsigned.key nginx-selfsigned.key.bak
   root@OS10:/etc/nginx/ssl# cp nginx-selfsigned.crt nginx-selfsigned.crt.bak
   root@OS10:/etc/nginx/ssl# rm /etc/nginx/ssl/nginx-selfsigned.crt
   root@OS10:/etc/nginx/ssl# ln -s /config/certs/Dell.crt /etc/nginx/ssl/nginx-selfsigned.crt
   root@OS10:/etc/nginx/ssl# rm /etc/nginx/ssl/nginx-selfsigned.key
   root@OS10:/etc/nginx/ssl# ln -s /config/certs/private/Dell.key /etc/nginx/ssl/nginx-selfsigned.key
   root@OS10:/etc/nginx/ssl# ls
   dhparam.pem  nginx-selfsigned.crt  nginx-selfsigned.crt.bak  nginx-selfsigned.key  nginx-selfsigned.key.bak
   root@OS10:/etc/nginx/ssl# ls -l
   total 12
   rw-rr- 1 root root  424 Mar  8  2020 dhparam.pem
   lrwxrwxrwx 1 root root   22 Nov  3 21:57 nginx-selfsigned.crt -> /config/certs/Dell.crt
   rw-rr- 1 root root 1135 Nov  3 21:56 nginx-selfsigned.crt.bak
   lrwxrwxrwx 1 root root   30 Nov  3 21:58 nginx-selfsigned.key -> /config/certs/private/Dell.key
   rw------ 1 root root 1708 Nov  3 21:55 nginx-selfsigned.key.bak
   

4. Check the nginx service status.

   root@OS10:/etc/nginx/ssl# service nginx status
   ● nginx.service - A high performance web server and a reverse proxy server
      Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
      Active: active (running) since Tue 2020-10-20 18:32:25 UTC; 2 weeks 0 days ago
        Docs: man:nginx(8)
     Process: 2451 ExecReload=/usr/sbin/nginx -g daemon on; master_process on; -s reload (code=exited, status=0/SUCCESS)
    Main PID: 641 (nginx)
      CGroup: /system.slice/nginx.service
              ├─ 641 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
              ├─2456 nginx: worker process
              └─2462 nginx: worker process
   Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
   

5. Restart the nginx service.

   root@OS10:/etc/nginx/ssl# service nginx restart