# Updating CA

## What is it?

My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.

The original one was built using cfssl.
I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
renew the cert, I just built a new CA from scratch.

Here is how.

## Make the CA

```
cd ~/Develop/jpace121-certificate-authority
j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
```

## Tell Nginx

```
scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
```
Then restart nginx.

## Tell Keycloak

```
base64 -w 0 ca/cert.pem
```

Copy to keycloak-config.yaml.

Deploy.

```
export KUBECONFIG=~/.kube/infra.yaml
kubectl apply -f keycloak-config.yaml
kubectl apply -f deployment.yaml
kubectl rollout restart deployment keycloak-deployment -n keycloak
```

Watch the logs:
```
kubectl logs -n keycloak deployment/keycloak-deployment keycloak
```