Import SSL Certificates

This section covers how to configure SSL certificate for new Uyuni installation, and how to replace existing certificates.

Before you begin, ensure you have:

A certificate authority (CA) SSL public certificate. If you are using a CA chain, all intermediate CAs must also be available.
An SSL server private key
An SSL server certificate
An SSL database private key
An SSL database certificate

All files must be in PEM format.

The hostname of the SSL server certificate must match the fully qualified hostname of the machine you deploy them on. You can set the hostnames in the X509v3 Subject Alternative Name section of the certificate. You can also list multiple hostnames if your environment requires it. Supported Key types are RSA and EC (Elliptic Curve).

Database SSL certificates require reportdb and db as Subject Alternative Name.

Third-party authorities commonly use intermediate CAs to sign requested server certificates. In this case, all CAs in the chain are required to be available. If there is no extra parameter or option available to specify intermediate CAs, take care that all CAs (Root CA and intermediate CAs) are stored in one file.

1. Import Certificates for New Installations

By default, Uyuni uses a self-signed certificate. After you have completed the initial setup, you can replace the default certificate with an imported certificate.

Procedure: Import Certificates on a New Uyuni Server

Deploy the Uyuni Server according to the instructions in Install Uyuni Server. Make sure to pass the correct files as parameters to mgradm install podman. The parameters are:

3rd Party SSL Certificate Flags:
      --ssl-ca-intermediate strings   Intermediate CA certificate path
      --ssl-ca-root string            Root CA certificate path
      --ssl-server-cert string        Server certificate path
      --ssl-server-key string         Server key path
      --ssl-db-cert string            Database certificate path
      --ssl-db-key string             Database key path

Intermediate CAs can either be available in the file which is specified with --ssl-ca-root or specified as extra options with --ssl-ca-intermediate. The --ssl-ca-intermediate option can be specified multiple times.

2. Import Certificates for New Proxy Installations

By default, Uyuni Proxy uses a self-signed certificate. After you have completed the initial setup, you can replace the default certificate with an imported certificate.

Procedure: Import Certificates on a New Uyuni Proxy

Install the Uyuni Proxy according to the instructions in Install Uyuni Proxy.
Follow the prompts to complete setup.

Use the same certificate authority (CA) to sign all server certificates for servers and proxies. Certificates signed with different CAs do not match.

3. Replace Certificates

You can replace active certificates on your Uyuni installation with a new certificate. To replace the certificates, you can replace the installed CA certificate with the new CA, and then update the database.

Procedure: Replacing All Existing Certificates

On the Uyuni container host, at the command prompt, recreate podman certificate secrets:

podman secret create --replace uyuni-ca $path_to_ca_certificate
podman secret create --replace uyuni-db-ca $path_to_database_ca_certificate
podman secret create --replace uyuni-cert $path_to_server_certificate
podman secret create --replace uyuni-key $path_to_server_key
podman secret create --replace uyuni-db-cert $path_to_database_certificate
podman secret create --replace uyuni-db-key $path_to_database_key
mgradm restart

Procedure: Restarting the Server

On the container host, restart the server to pick up the changes:
```
mgradm restart
```

If you are using a proxy, you need to generate a server certificate RPM for each proxy, using their hostnames and cnames. Generate a new configuration tarball and deploy it.

For more information, see installation-and-upgrade:container-deployment/uyuni/proxy-deployment-uyuni.adoc#proxy-setup-containers-generate-config. proxy-deployment-uyuni.adoc

If the Root CA was changed, it needs to get deployed to all the clients connected to Uyuni.

Procedure: Deploying the Root CA on Clients

In the Uyuni Web UI, navigate to Systems Overview.
Check all your clients to add them to the system set manager.
Navigate to Systems System Set Manager Overview.
In the States field, click Apply to apply the system states.
In the Highstate page, click Apply Highstate to propagate the changes to the clients.