update certs

docs/updating-ca.md

@@ -0,0 +1,47 @@
+# Updating CA
+
+## What is it?
+
+My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
+
+The original one was built using cfssl.
+I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
+renew the cert, I just built a new CA from scratch.
+
+Here is how.
+
+## Make the CA
+
+```
+cd ~/Develop/jpace121-certificate-authority
+j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
+```
+
+## Tell Nginx
+
+```
+scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
+```
+Then restart nginx.
+
+## Tell Keycloak
+
+```
+base64 -w 0 ca/cert.pem
+```
+
+Copy to keycloak-config.yaml.
+
+Deploy.
+
+```
+export KUBECONFIG=~/.kube/infra.yaml
+kubectl apply -f keycloak-config.yaml
+kubectl apply -f deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
+
+Watch the logs:
+```
+kubectl logs -n keycloak deployment/keycloak-deployment keycloak
+```