Certificate maintenance¶
When client or server certificates expire, they need to be renewed.
Renew server certificates¶
Use the same commands that were used to create the initial key/certs:
xbusd key generatexbusd cert generate server-ca [ --host-defs <server names/ips> ]xbusd cert generate client-ca- Restart xbusd
After doing so, all the client certificates _must_ be renewed.
Renew client certificate¶
Reset the cert¶
The client certificate renewal must be initiated server-side, with xbusctl
(or directly xbusd if no xbusctl can connect):
xbusctl account reset-cert <account name or id>
After running this command, the account state is back to PENDING, and both
its certificate and CSR are reset.
Renew the CSR¶
The client utility (xbus-client or xbusctl ) can now provide a new CSR,
and optionnaly renew its private key:
xbus-client renew-cert [ --newkey ]
Accept the new CSR¶
The administrator now has to accept the account to generate a new certificate:
xbusctl account accept <account name or id>
Install the new certificate¶
Finalize the operation by fetching and install the new certificate:
xbus-client register
