Changes between Initial Version and Version 1 of GENIRacksHome/OpenGENIRacks/RenewKeystoneKeys

Timestamp:

02/27/15 09:54:54 (9 years ago)

Author:

sdabideen@bbn.com

Comment:

--

GENIRacksHome/OpenGENIRacks/RenewKeystoneKeys

@@ +1 @@
+Keystone certs expire every year
+
+From /etc/keystone/ssl/certs
+
+# This makes the Certificate Signing Request (CSR)
+openssl req -newkey rsa:2048 -keyout signing_key.pem -keyform PEM -out signing_\
+cert_req.pem -outform PEM -config openssl.conf -nodes
+Unset
+Unset
+Unset
+Unset
+Unset
+US
+clemson-clemson-control-1
+
+
+openssl ca -config openssl.conf -keyfile cakey.pem -cert ca.pem -in signing_cer\
+t_req.pem -out signing_cert_new.pem
+y
+y
+
+
+Change the permissions of the new cert:
+chown keystone.keystone signing_cert_new.pem
+
+
+sudo keystone-manage pki_setup  --keystone-user keystone --keystone-group keystone
+
+
+The other openstack services maintain their own copy of the cert, so you must replace them:
+cp /etc/keystone/ssl/certs/ca.pem /var/lib/nova/keystone-signing/cacert.pem
+cp /etc/keystone/ssl/certs/signing_cert.pem /var/lib/nova/keystone-signing/signing_cert.pem
+restart nova-api
+cp /etc/keystone/ssl/certs/ca.pem /var/lib/cinder/cacert.pem
+cp /etc/keystone/ssl/certs/signing_cert.pem /var/lib/cinder/signing_cert.pem
+restart cinder-api
+cp /etc/keystone/ssl/certs/ca.pem /var/lib/quantum/keystone-signing/cacert.pem
+cp /etc/keystone/ssl/certs/signing_cert.pem /var/lib/quantum/keystone-signing/signing_cert.pem
+restart quantum-server
+cp /etc/keystone/ssl/certs/ca.pem /var/lib/glance/keystone-signing/cacert.pem
+cp /etc/keystone/ssl/certs/signing_cert.pem /var/lib/glance/keystone-signing/signing_cert.pem
+restart glance-api
+restart glance-registry
+
+
+