How to clean up expired security_configuration.trusted_certificates
Article ID: 293792
Updated On:
Products
Issue/Introduction
This feature enables all BOSH-deployed components in your deployment to trust custom root certificates. As is described here https://docs.pivotal.io/ops-manager/2-8/trusted-certificates.html
They show up in the list of certificates page with name like .security_configuration.trusted_certificates[1]
Sometimes those custom certificates expire, and trigger OpsMan to show a warning about it.
The number next to the name of certificate is representing a position in an array. For future to be able to identify what certificate is used for you can put a hashtag in line prior to certificate, such as
#digicert for appX, expiring date Y
Environment
Resolution
The only way to clean up those certificates is to use manual method:
1. Copy certificates from Bosh director --> Security --> Trusted Certificates to a backup-certs.txt file.
2. Create a new file working-certs.txt.
3. Manually copy each certificates from backup-certs.txt to your terminal or certificate decoder tool (for example https://certlogik.com/decoder/ ) to decode and check for the validity date.
If doing it in terminal commands printf -- "CERT" will print in correct format if needed, paste it into a new file called cert.crt and then use command openssl x509 -in cert.crt -text -noout to decode the certificate so you can check its details specifically if it is still valid or expired.
4. This step will have to be done for each individual certificate in Bosh director --> Security --> Trusted Certificates. Once you find certificates that are still valid, put them in working-certs.txt. Once completed checking each of the certificates, copy contents of working-certs.txt into Bosh director --> Security --> Trusted Certificates, click Save and run Apply Changes on Bosh director only.
NOTE: this procedure is designed only to remove expired certificates from Trusted Certificates, this is not the process to rotate those certificates.
Feedback
