Chapter 8. Renewing and changing the SSL certificate If your current SSL certificate has expired or will expire soon, you can either renew or replace the SSL certificate used by Ansible Automation Platform. You must renew the SSL certificate if you need to regenerate the SSL certificate with new information such as new hosts. You must replace the SSL certificate if you want to use an SSL certificate signed by an internal certificate authority. 8.1. Renewing the self-signed SSL certificate The following steps regenerate a new SSL certificate for both automation controller and automation hub. Procedure Add aap_service_regen_cert=true to the inventory file in the [all:vars] section: [all:vars] aap_service_regen_cert=true Run the installer. Verification Validate the CA file and server.crt file on automation controller: openssl verify -CAfile ansible-automation-platform-managed-ca-cert.crt /etc/tower/tower.cert openssl s_client -connect <AUTOMATION_HUB_URL>:443 Validate the CA file and server.crt file on automation hub: openssl verify -CAfile ansible-automation-platform-managed-ca-cert.crt /etc/pulp/certs/pulp_webserver.crt openssl s_client -connect <AUTOMATION_CONTROLLER_URL>:443 8.2. Changing SSL certificates To change the SSL certificate, you can edit the inventory file and run the installer. The installer verifies that all Ansible Automation Platform components are working. The installer can take a long time to run. Alternatively, you can change the SSL certificates manually. This is quicker, but there is no automatic verification. Red Hat recommends that you use the installer to make changes to your Ansible Automation Platform instance. 8.2.1. Prerequisites If there is an intermediate certificate authority, you must append it to the server certificate. Both automation controller and automation hub use NGINX so the server certificate must be in PEM format. Use the correct order for the certificates: The server certificate comes first, followed by the intermediate certificate authority. For further information, see the ssl certificate section of the NGINX documentation . 8.2.2. Changing the SSL certificate and key using the installer The following procedure describes how to change the SSL certificate and key in the inventory file. Procedure Copy the new SSL certificates and keys to a path relative to the Ansible Automation Platform installer. Add the absolute paths of the SSL certificates and keys to the inventory file. Refer to the Automation controller variables , Automation hub variables , and Event-Driven Ansible controller variables sections of the Red Hat Ansible Automation Platform Installation Guide for guidance on setting these variables. Automation controller: web_server_ssl_cert , web_server_ssl_key , custom_ca_cert Automation hub: automationhub_ssl_cert , automationhub_ssl_key , custom_ca_cert Event-Driven Ansible controller: automationedacontroller_ssl_cert , automationedacontroller_ssl_key , custom_ca_cert Note The custom_ca_cert must be the root certificate authority that signed the intermediate certificate authority. This file is installed in /etc/pki/ca-trust/source/anchors . Run the installer. 8.2.3. Changing the SSL certificate manually 8.2.3.1. Changing the SSL certificate and key manually on automation controller The following procedure describes how to change the SSL certificate and key manually on Automation Controller. Procedure Backup the current SSL certificate: cp /etc/tower/tower.cert /etc/tower/tower.cert-USD(date +%F) Backup the current key files: cp /etc/tower/tower.key /etc/tower/tower.key-USD(date +%F)+ Copy the new SSL certificate to /etc/tower/tower.cert . Copy the new key to /etc/tower/tower.key . Restore the SELinux context: restorecon -v /etc/tower/tower.cert /etc/tower/tower.key Set appropriate permissions for the certificate and key files: chown root:awx /etc/tower/tower.cert /etc/tower/tower.key chmod 0600 /etc/tower/tower.cert /etc/tower/tower.key Test the NGINX configuration: nginx -t Reload NGINX: systemctl reload nginx.service Verify that new SSL certificate and key have been installed: true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443 8.2.3.2. Changing the SSL certificate and key on automation controller on OpenShift Container Platform The following procedure describes how to change the SSL certificate and key for automation controller running on OpenShift Container Platform. Procedure Copy the signed SSL certificate and key to a secure location. Create a TLS secret within OpenShift: oc create secret tls USD{CONTROLLER_INSTANCE}-certs-USD(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key Modify the automation controller custom resource to add route_tls_secret and the name of the new secret to the spec section. oc edit automationcontroller/USD{CONTROLLER_INSTANCE} ... spec: route_tls_secret: automation-controller-certs-2023-04-06 ... The name of the TLS secret is arbitrary. In this example, it is timestamped with the date that the secret is created, to differentiate it from other TLS secrets applied to the automation controller instance. Wait a few minutes for the changes to be applied. Verify that new SSL certificate and key have been installed: true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443 8.2.3.3. Changing the SSL certificate and key on Event-Driven Ansible controller The following procedure describes how to change the SSL certificate and key manually on Event-Driven Ansible controller. Procedure Backup the current SSL certificate: cp /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.cert-USD(date +%F) Backup the current key files: cp /etc/ansible-automation-platform/eda/server.key /etc/ansible-automation-platform/eda/server.key-USD(date +%F) Copy the new SSL certificate to /etc/ansible-automation-platform/eda/server.cert . Copy the new key to /etc/ansible-automation-platform/eda/server.key . Restore the SELinux context: restorecon -v /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key Set appropriate permissions for the certificate and key files: chown root:eda /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key chmod 0600 /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key Test the NGINX configuration: nginx -t Reload NGINX: systemctl reload nginx.service Verify that new SSL certificate and key have been installed: true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443 8.2.3.4. Changing the SSL certificate and key manually on automation hub The following procedure describes how to change the SSL certificate and key manually on automation hub. Procedure Backup the current SSL certificate: cp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.crt-USD(date +%F) Backup the current key files: cp /etc/pulp/certs/pulp_webserver.key /etc/pulp/certs/pulp_webserver.key-USD(date +%F) Copy the new SSL certificate to /etc/pulp/certs/pulp_webserver.crt . Copy the new key to /etc/pulp/certs/pulp_webserver.key . Restore the SELinux context: restorecon -v /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key Set appropriate permissions for the certificate and key files: chown root:pulp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key chmod 0600 /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key Test the NGINX configuration: nginx -t Reload NGINX: systemctl reload nginx.service Verify that new SSL certificate and key have been installed: true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443

Commands:
[all:vars] aap_service_regen_cert=true
openssl verify -CAfile ansible-automation-platform-managed-ca-cert.crt /etc/tower/tower.cert openssl s_client -connect <AUTOMATION_HUB_URL>:443
openssl verify -CAfile ansible-automation-platform-managed-ca-cert.crt /etc/pulp/certs/pulp_webserver.crt openssl s_client -connect <AUTOMATION_CONTROLLER_URL>:443
cp /etc/tower/tower.cert /etc/tower/tower.cert-USD(date +%F)
cp /etc/tower/tower.key /etc/tower/tower.key-USD(date +%F)+
restorecon -v /etc/tower/tower.cert /etc/tower/tower.key
chown root:awx /etc/tower/tower.cert /etc/tower/tower.key chmod 0600 /etc/tower/tower.cert /etc/tower/tower.key
nginx -t
systemctl reload nginx.service
true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443
create secret tls USD{CONTROLLER_INSTANCE}-certs-USD(date +%F) --cert=/path/to/ssl.crt --key=/path/to/ssl.key
edit automationcontroller/USD{CONTROLLER_INSTANCE}
spec: route_tls_secret: automation-controller-certs-2023-04-06
true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443
cp /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.cert-USD(date +%F)
cp /etc/ansible-automation-platform/eda/server.key /etc/ansible-automation-platform/eda/server.key-USD(date +%F)
restorecon -v /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key
chown root:eda /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key
chmod 0600 /etc/ansible-automation-platform/eda/server.cert /etc/ansible-automation-platform/eda/server.key
nginx -t
systemctl reload nginx.service
true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443
cp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.crt-USD(date +%F)
cp /etc/pulp/certs/pulp_webserver.key /etc/pulp/certs/pulp_webserver.key-USD(date +%F)
restorecon -v /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
chown root:pulp /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
chmod 0600 /etc/pulp/certs/pulp_webserver.crt /etc/pulp/certs/pulp_webserver.key
nginx -t
systemctl reload nginx.service
true | openssl s_client -showcerts -connect USD{CONTROLLER_FQDN}:443