Isilon: PowerScale: OneFS: How to replace or renew the SSL certificate that is used for the Isilon web administration interface

Introduction

This article explains how to replace or renew the Secure Sockets Layer (SSL) certificate for the Isilon web administration interface. The following procedures include options to complete a self-signed certificate replacement or renewal, or to request an SSL replacement or renewal from a Certificate Authority (CA).

Requisite tools or skills

To complete this task, you must have the URL for accessing the Isilon web administration interface. (The examples in this article use https://isilon.example.com:8080/.) You should also be comfortable running commands from the command line.

Pre-requisites

Reference information

The following lists include the default locations for the server.crt and server.key files in OneFS 7.0.x and OneFS 8.0.0.x. In the procedures that follow, update the steps to match this information for the version of OneFS that is installed.

OneFS 7.0.x and later

• SSL certificate: /usr/local/apache24/conf/ssl.crt/server.crt
• SSL certificate key: /usr/local/apache24/conf/ssl.key/server.key

OneFS 8.0.1.x and later

1. Obtain the list of certificates from running the below command:    

2. Save a backup of the original certificate and key (only for OneFS 7.0.x to 8.0.0.x).
   1. Open an SSH connection on any node in the cluster and log in using the "root" account.
   2. Run the following commands to create a backup location and save the original key and certificate:     

mkdir -p /ifs/data/Isilon_Support/original_ssl_backup
cp /usr/local/apache24/conf/ssl.crt/server.crt /ifs/data/Isilon_Support/original_ssl_backup
cp /usr/local/apache24/conf/ssl.key/server.key /ifs/data/Isilon_Support/original_ssl_backup  

Procedure

1. Create a local working directory. 

mkdir /ifs/local
cd /ifs/local

Renew an existing self-signed Certificate.

cp /usr/local/apache2/conf/ssl.key/server.key ./ ; openssl req -new -days 730 -nodes -x509 -key server.key -out server.crt

When finished entering the information, the server.csr and server.key files appear in the /ifs/local directory.

• (Optional) Verify the integrity and attributes of the certificate:     

openssl x509 -text -noout -in server.crt

         Create a certificate and key. 

openssl genrsa -out server.key 2048

openssl req -new -nodes -key server.key -out server.csr

• (Optional) Generate a CSR for a Certificate Authority which includes Subject-Alternative-Names. If additional DNS is needed, it can be added by using a comma, (For example: DNS:example.com,DNS:www.example.com)

openssl req -new -nodes -key server.key -out server.csr -reqexts SAN -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:example.com"))

Self-Sign the SSL Certificate. 

openssl x509 -req -days 730 -in server.csr -signkey server.key -out server.crt

openssl x509 -noout -modulus -in server.crt | openssl md5           
openssl rsa -noout -modulus -in server.key | openssl md5

Go to "Add the certificate to the cluster." Section of this KB after this step. 

Get a CA to Sign the Certificate.

If a CA is signing the certificate, ensure that the new SSL certificate is in x509 format, and includes the entire certificate trust chain.

It is common for CAs to return the new SSL certificate, the intermediate certificate, and the root certificate in separate files.

If the CA has done this, you must manually create the PEM formatted certificate.

Order matters when creating the PEM formatted certificate. Your cert must be at the top of the file, followed by the intermediate certificates, and the root certificate must be at the bottom.

Here is an example of what the PEM formatted file looks like:        

An easy way to create the PEM formatted file from the CLI is to cat the files (remember, the order of the files matter):       

cat CA_signed.crt intermediate.crt root.crt > onefs_pem_formatted.crt

• (Optional) Verify the integrity and attributes of the certificate:       

openssl x509 -text -noout -in server.crt

         
Add the certificate to the cluster.    

• FOR OneFS 7.0.X TO 8.0.1.X

1. Install the new certificate and key on each node:     

isi services -a isi_webui disable
chmod 640 server.key
chmod 640 server.crt
isi_for_array -s 'cp /ifs/local/server.key /usr/local/apache2/conf/ssl.key/server.key'
isi_for_array -s 'cp /ifs/local/server.crt /usr/local/apache2/conf/ssl.crt/server.crt'
isi services -a isi_webui enable

• FOR OneFS 8.0.1.X AND LATER

1. Import the new certificate and key into the system:      

isi certificate server import /ifs/local/server.crt /ifs/local/server.key

2. Verify that the certificate imported successfully:     

isi certificate server list -v 

3. Set the imported certificate as default:      

• For OneFS 8.0 and 8.1, the command is:      

isi certificate server modify --id=<id_of_cert_to_set_as_default> --default

• For OneFS 8.2 and later, the command is:      

isi certificate settings modify --default-https-certificate=<id_of_cert_to_set_as_default>

4. Use the below command to confirm that the imported certificate is being used as default by verifying status of "Default HTTPS Certificate":     

isi certificate settings view

5. If there is an unused or outdated cert, delete this with the command:      

isi certificate server delete --id=<id_of_cert_to_delete>

6. View the new imported cert with command:      

isi certificate server view --id=<id_of_cert>

isi services -a isi_webui disable
chmod 640 server.key
chmod 640 server.crt
isi_for_array -s 'cp /ifs/local/server.key /usr/local/apache2/conf/ssl.key/server.key'
isi_for_array -s 'cp /ifs/local/server.crt /usr/local/apache2/conf/ssl.crt/server.crt'
isi services -a isi_webui enable

Verification

There are two methods for verifying the updated SSL certificate.

• From a web browser

1. Browse to https://<common name>:8080, where <common name> is the hostname that is used to access the Isilon web administration interface (for example, isilon.example.com).
2. View the security details for the web page. The steps to do this vary by browser. In some browsers, click the padlock icon in the address bar to view the security details for the web page.
3. In the security details for the web page, verify that the subject line and other details are correct. An output similar to the following is displayed, where <yourstate>, <yourcity>, and <your company> are the state, city, and name of your organization:     

• From a command line

1. Open an SSH connection on any node in the cluster and log in using the "root" account.
2. Run the following command:      

echo QUIT | openssl s_client -connect localhost:8080

3. An output similar to the following is displayed, where <yourstate>, <yourcity>, and <your company> are the state, city, and name of your organization: