Purpose:
Section titled “Purpose:”Steps needed to refresh the Halo.app SSL certificate for the application.
Scope:
Section titled “Scope:”Halo administration
Responsibility:
Section titled “Responsibility:”Technology
Completion Criteria:
Section titled “Completion Criteria:”If steps are performed correctly the Halo.app SSL certificate will be extended/renewed.
Records:
Section titled “Records:”not applicable
Steps:
Section titled “Steps:”- Cert should auto-renew w/ GoDaddy
- Download certificate package in GoDaddy portal (server type: Other) and extract contents into a temp directory (e.g. C:\Temp_.Halo.app)
- Rename extracted .pem file to Halo.app.pem
- Copy Halo.app.key (will be same key file as used previously unless ssl cert is rekeyed) into cert directory (e.g. C:\Temp_.Halo.app) where files were extracted
- Run: openssl pkcs12 -export -in Halo.app.pem -inkey Halo.app.key -certfile gd_bundle-g2-g1.crt -out Halo.app.p12 (when prompted for password use f8f8f8f8) a. Use MS Windows for Linux Subsystem prompt if needed for openssl command
- Download and install openjdk 20.0.2, then run: C:\Temp\openjdk\jdk-20.0.2\bin\keytool -importkeystore -srckeystore C:\Temp_.Halo.app\Halo.app.p12 -srcstoretype pkcs12 -destkeystore C:\Temp_.Halo.app\Halo.app.jks -deststoretype jks (when prompted for passwords enter f8f8f8f8 a. Use Windows Command Prompt as admin if needed
- Copy to dev.Halo.app server: scp Halo.app.jks dev.Halo.adm@10.10.50.43:/tmp a. Should be done from wherever .jks file was created (e.g. navigate to temp directory: cd C:\Temp_.Halo.app)
- Log into dev.Halo.app as dev.Halo.adm: ssh dev.Halo.adm@10.10.50.43
- Run: sudo -su root (enter dev.Halo.adm password)
- Go to tmp directory and run: mv Halo.app.jks /f8/certs (overwrite if prompted)
- Go to /f8/certs and run: a. chown root Halo.app.jks b. chgrp root Halo.app.jks c. chmod 644 Halo.app.jks
- Backup existing Halo-app.jks: cp Halo-app.jks Halo-app.jks_bkp06132024 (replace that date w/ date of backup)
- Shut down both ds and ui a. /f8/sites/centrexit/ui/bin/shutdown.sh b. /f8/sites/centrexit/ds/bin/shutdown.sh
- Verify services have halted: ps -ef | grep f8
- Rename existing Halo-app.jks: mv Halo-app.jks Halo-app.jks_old
- Rename new Halo.app.jks: mv Halo.app.jks Halo-app.jks
- Restart ds and ui a. /f8/sites/centrexit/ds/bin/startup.sh b. /f8/sites/centrexit/ui/bin/startup.sh
- Update public key (Certificate chain PEM) in Halo.app certs stored in System > Credibility > Certificates, may be in production/service provider and root spaces
- Validate the SSL certificate has been updated by accessing the certificate from application website. To move to prod repeat steps but use prod app server and Halo.adm password (also use for sudo -su root command): ssh Halo.adm@10.20.21.11
The /f8/certs/Halo-app.jks and password f8f8f8f8 are specified in startup files for ds/ui.
Process References:
Section titled “Process References:”- Create a relationship back to related process. Note: Please add KB relationships to core process, process, SOPs or other WIs on the right.