How to Update Expiring SSL/TLS Certificates on DX NetOps Proxy Server

Products

• Network Observability
• CA Performance Management

Issue/Introduction

The SSL/TLS certificates used by the DX NetOps Proxy server are expiring. To maintain secure communication between the Data Aggregator and the Proxy, the existing certificate chain and keypair must be replaced before the expiration date.

 

Environment

• DX NetOps Performance Management
• Fault-Tolerant (FT) Data Aggregator configuration
• Proxy Host (daproxy)

Cause

SSL/TLS certificates have a finite validity period and require manual replacement once they approach their expiration date.

 

Resolution

To update the SSL/TLS certificates on the Proxy server, follow these steps:

1. Generate New Certificates: Obtain a new keypair and a full certificate chain from your Certificate Authority (CA). The PEM-formatted certificate file should contain the certificates in the following order:

   • Signed Server Certificate
   • Intermediate Certificate(s)
   • Root Certificate

2. Upload Files to Proxy Server: Place the new .pem certificate file and the corresponding .key file on the Proxy server (standard location: /opt/CA/daproxy/conf/). Ensure the file permissions allow the daproxy service to read them.

3. Update Configuration: Edit the /opt/CA/daproxy/conf/daproxy.toml file. Locate the [[tls.certificates]] and [[tls.stores.default.defaultCertificate]] sections and ensure the certFile and keyFile parameters point to the new file paths :

   toml

    

   [[tls.certificates]]  
   certFile = "/opt/CA/daproxy/conf/new_certificate.pem"  
   keyFile = "/opt/CA/daproxy/conf/new_key.key"
   
   [[tls.certificates]]
       certFile = "/opt/CA/daproxy/conf/new_certificate.pem"  
       keyFile = "/opt/CA/daproxy/conf/new_key.key"
    [tls.stores]
     [tls.stores.default]
       [tls.stores.default.defaultCertificate]
         certFile = "/opt/CA/daproxy/conf/new_certificate.pem"  
         keyFile = "/opt/CA/daproxy/conf/new_key.key"

4. Restart Service: Apply the changes by restarting the daproxy service:

   bash

    

   systemctl restart daproxy

5. Verification: Confirm the service is running and presenting the new certificate by checking the status:

   bash

    

   systemctl status daproxy