Currently Meta servers (meta*.org, a-1.thiss.io and a-staging-1.thiss.io), load balancer servers (md*.org and static.*org, md-lb.thiss.io. static.thiss.io, static.aws2.thiss.io) uses SUNET Infra certs.

We monitor them in https://monitor.seamlessaccess.org/nagios4/.

STEP BY STEP GUIDE

  1. Follow https://wiki.sunet.se/display/sunetops/How+to+create+infra+cert  cert according to the guide
  2. Check under nunoc-ops/ca.sunet.se/overlay/var/lib/ca/infra/requests/<peer/server/client> to see whether the curent CSR was created as peer, server or client.
  3. Certificate type for load balancer servers are 'peer' and Meta servers are 'server'
  4. The key needs to be added to the server manually.
  5. To get the cert on the server you need to manually run the cronjob for example  /usr/bin/dl_ici_cert infra static.aws1.geant.eu.seamlessaccess.org
  6. run cosmos on the servers, run-cosmos -v
  7. Check the validity by running openssl x509 -text -noout -in /etc/ssl/private/<fqdn>_infra.pem
  8. Check the validity by running  openssl x509 -text -noout -in /etc/ssl/private/<fqdn>_haproxy.crt, applies only to load balancer servers.
  9. if both chains and key are updated (will have the same expiry date one year from now) then you can restart service.

Check the service is working by running:

  • Run:   curl -k https://localhost/              on md.*.org servers, will show metadata information 
  • Run:   curl -k https://localhost/manifest.json on static.*.org servers will show right version
  • Run:   curl -k https://localhost                                 on meta.*.org servers will show avaialbe metadata files
  • There are no alarms in https://monitor.seamlessaccess.org/nagios4/.




  

  • No labels