48 lines
967 B
Markdown
48 lines
967 B
Markdown
# Updating CA
|
|
|
|
## What is it?
|
|
|
|
My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
|
|
|
|
The original one was built using cfssl.
|
|
I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
|
|
renew the cert, I just built a new CA from scratch.
|
|
|
|
Here is how.
|
|
|
|
## Make the CA
|
|
|
|
```
|
|
cd ~/Develop/jpace121-certificate-authority
|
|
j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
|
|
```
|
|
|
|
## Tell Nginx
|
|
|
|
```
|
|
scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
|
|
```
|
|
Then restart nginx.
|
|
|
|
## Tell Keycloak
|
|
|
|
```
|
|
base64 -w 0 ca/cert.pem
|
|
```
|
|
|
|
Copy to keycloak-config.yaml.
|
|
|
|
Deploy.
|
|
|
|
```
|
|
export KUBECONFIG=~/.kube/infra.yaml
|
|
kubectl apply -f keycloak-config.yaml
|
|
kubectl apply -f deployment.yaml
|
|
kubectl rollout restart deployment keycloak-deployment -n keycloak
|
|
```
|
|
|
|
Watch the logs:
|
|
```
|
|
kubectl logs -n keycloak deployment/keycloak-deployment keycloak
|
|
```
|