How to Update a CA-Signed Certificate in Virtual Network Assurance

Products

• Network Observability

Issue/Introduction

You are currently using a CA-signed certificate for Network Observability (VNA) and require an update because the existing certificate is expiring. You need to apply the new CA-signed certificate while maintaining your existing private key in the environment.

Environment

Virtual Network Assurance: All

Resolution

To update your certificate, perform the following steps:

 

1. Backup your keystore file: Create a backup of the existing keystore.jks file before making any modifications:
  
   
        cp /opt/CA/VNA/wildfly/standalone/configuration/keystore.jks /opt/CA/VNA/wildfly/standalone/configuration/keystore.jks.backup

   
   
2. Import the CA Root certificate: Use the keytool command to import the CA Root certificate:
  
   
        keytool -import -alias caroot -keystore /opt/CA/VNA/wildfly/standalone/configuration/keystore.jks -trustcacerts -file <fileName>

   
   
3. Import the CA Intermediary certificate: Use the keytool command to import the CA Intermediary certificate:

   
       keytool -import -alias cainter -keystore /opt/CA/VNA/wildfly/standalone/configuration/keystore.jks -trustcacerts -file <fileName>

   
   
4. Import the updated certificate: Use the keytool command to import your updated certificate file:

   
      keytool -import -alias cavna -keystore /opt/CA/VNA/wildfly/standalone/configuration/keystore.jks -trustcacerts -file <fileName>

   
   
5. Restart Wildfly: Restart the Wildfly service to apply the changes:

   
       systemctl stop wildfly 

    systemctl start wildfly
   
   
   

Note: If the installation path to your VNA instance differs from /opt/CA/VNA, adjust the paths in the commands above to match your specific environment.

Note: In some cases, you may also need to provide a path to the keytool binary (xxxx/java/bin/keytool), this command may help locate the java location: alternatives --display java