Basic sanity verification for ca.pem, cert.pem, privatekey.pem and passphrase.txt, files:

1. Execute the following commands and ensure that the output of both the commands result in a matching value for cert.pem and privatekey.pem files:

   $ openssl x509 -noout -modulus -in cert.pem | openssl sha256

   $ openssl rsa -noout -modulus -in privatekey.pem -passin file:passphrase.txt | openssl sha256

2. Check the validity of the certificate and presence of the primary server name in the certificate by executing the following command to list the certificate details:

   $ openssl x509 -text -in cert.pem -noout

   Verify the Not Before and Not After fields display the certificate is valid and has not expired. Confirm that the primary server name appears in the X509v3 Subject Alternative Name. If X509v3 Subject Alternative Name is missing, then confirm that the primary server name appears in the Subject as a CN.

3. Execute the following command to verify that a complete certificate chain exists in cert.pem and ca.pem files:

   $ openssl verify -CAfile ca.pem -untrusted cert.pem cert.pem

   cert.pem: OK

Configure an external certificate for the first time

1. Log in to the host where the Kubernetes cluster is managed and has the kubectl command.
2. Execute the following commands to create the tpcredentials directory and copy the artifacts into the primary pod:

   $ kubectl exec -it <primary_pod_name> -n <namespace> -- mkdir -p /usr/openv/var/global/wsl/credentials/tpcredentials

   $ kubectl cp <path_to_ca.pem> <primary_pod_name>:/usr/openv/var/global/wsl/credentials/tpcredentials/ca.pem -n <namespace>

   $ kubectl cp <path_to_cert.pem> <primary_pod_name>:/usr/openv/var/global/wsl/credentials/tpcredentials/cert.pem -n <namespace>

   $ kubectl cp <path_to_privatekey.pem> <primary_pod_name>:/usr/openv/var/global/wsl/credentials/tpcredentials/privatekey.pem -n <namespace>

   $ kubectl cp <path_to_passphrase.txt> <primary_pod_name>:/usr/openv/var/global/wsl/credentials/tpcredentials/passphrase.txt -n <namespace>

3. Execute the following commands to ensure the directory and files are created with correct ownership. Ensure that the owner has full permissions on the directory and files.

   $ kubectl exec -it <primary_pod_name> -n <namespace> -- chown -R nbwebsvc:nbwebgrp /usr/openv/var/global/wsl/credentials/tpcredentials

   $ kubectl exec -it <primary_pod_name> -n <namespace> -- chmod u+rwx /usr/openv/var/global/wsl/credentials/tpcredentials

   $ kubectl exec -it <primary_pod_name> -n <namespace> -- chmod -R u+rw /usr/openv/var/global/wsl/credentials/tpcredentials

4. Restart the nbwsapp pod.

   Use the following commands to list all the pods from the namespace, then select the nbwsapp pod and delete it.

   $ kubectl get pods -n <namespace>

   $ kubectl delete pod <nbwsapp_pod_name> -n <namespace>

5. Use the following command to ensure that the nbwsapp pod is up and running:

   $ kubectl get pods -n <namespace> | grep nbwsapp

   <nbwsapp_pod_name>                        4/4     Running   0          9m44s

6. Execute the following commands to create the keystore:

   $ kubectl exec -it <nbwsapp_pod_name> -n <namespace> -- bash

   $ cp /usr/openv/var/global/wsl/credentials/tpcredentials/passphrase.txt /usr/openv/var/global/wsl/credentials/tpcredentials/jkskey

   $ /usr/openv/netbackup/bin/goodies/vxsslcmd pkcs12 -export -inkey /usr/openv/var/global/wsl/credentials/tpcredentials/privatekey.pem -in /usr/openv/var/global/wsl/credentials/tpcredentials/cert.pem -out /tmp/cert.p12 -passin file:/usr/openv/var/global/wsl/credentials/tpcredentials/passphrase.txt -passout file:/usr/openv/var/global/wsl/credentials/tpcredentials/jkskey -name eca

   Note:

   Ignore the following error message if displayed by the last command above:

   unable to write 'random state'

   $ ls -l /tmp/cert.p12

   -rw-r--r-- 1 nbwebsvc nbwebgrp   4420 Sep 20 19:44 cert.p12

   $ export KEYSTORE_PASS=$(cat /usr/openv/var/global/wsl/credentials/tpcredentials/jkskey)

   $ /usr/openv/java/jre/bin/keytool -storetype BCFKS -providerpath /usr/openv/wmc/webserver/lib/ccj.jar -providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider -importkeystore -srckeystore /tmp/cert.p12 -srcstoretype pkcs12 -srcstorepass ${KEYSTORE_PASS} -destkeystore /tmp/nbwebservice.bcfks -deststorepass ${KEYSTORE_PASS}

   Importing keystore /tmp/cert.p12 to /tmp/nbwebservice.bcfks...
   Entry for alias eca successfully imported.
   Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

   $ mv /tmp/nbwebservice.bcfks /usr/openv/var/global/wsl/credentials/tpcredentials/

   keytool -storetype BCFKS -providerpath /usr/openv/wmc/webserver/lib/ccj.jar -providerclass com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider -importcert -alias ca -file /usr/openv/var/global/wsl/credentials/tpcredentials/ca.pem -keystore /usr/openv/var/global/wsl/credentials/tpcredentials/nbwebservice.bcfks -srcstorepass ${KEYSTORE_PASS} -deststorepass ${KEYSTORE_PASS}

7. The new certificate will be automatically applied within 30 minutes, or you can restart the requestrouter pod to apply it immediately by using the following commands:

   $ kubectl get pods -n <namespace>

   $ kubectl delete pod <requestrouter_pod_name> -n <namespace>