Renewing SSL/TLS certificates for standalone harbor integrated with TCA

Products

• VMware Telco Cloud Automation

Issue/Introduction

• Harbor is deployed as a standalone server (external integration) and not as an orchestrated Cloud Native Network Function (CNF) via TCA.
• Hence,the standard certificate renewal procedures via TCA is not applicable.

Environment

• VMware Telco Cloud Automation : 3.1.1 
• Harbor version : 2.7.x 

Cause

• The SSL/TLS certificates securing the external Harbor standalone server have expired or are nearing expiration.
• Because Harbor is running outside of the TCA-managed cluster footprint, standard automated TCA lifecycle management workflows cannot renew these certificates natively.

Resolution

Prerequisites :

• Access the Harbor standalone server via SSH with root or sudo privileges.
• The new certificate files generated by your Certificate Authority (CA):
  
  
  • Certificate File  : yourdomain.com.crt (or .pem, including any intermediate chain certificates)
  • Private Key File: yourdomain.com.key


• If using self-signed certificates, the root CA certificate (ca.crt).
  
  

Update Certificates on the Standalone Harbor Server :

1. Log in to the Harbor standalone host via SSH.

2. Locate the existing certificate files. (By default, these are often located in /data/cert/ or the directory specified in your harbor.yml file).

3. Back up the existing expired certificates:  

      #cp /data/cert/yourdomain.com.crt /data/cert/yourdomain.com.crt.bak
 
   #cp /data/cert/yourdomain.com.key /data/cert/yourdomain.com.key.bak

   #cp ca.crt /etc/docker/certs.d/yourdomain.com/

4. Copy the new certificate and private key into the certificate directory, ensuring they match the file names used in your harbor.yml configuration.
 
5. Set appropriate permissions on the private key: 

             # chmod 600 /data/cert/yourdomain.com.key

         6. Navigate to your Harbor installation directory (where harbor.yml and the prepare script reside, e.g., /usr/local/harbor):

             # cd /usr/local/harbor

          7. Run the prepare script to regenerate the internal container configurations with the new certificates:

   # sudo ./prepare --with-chartmuseum

8.  Stop and Restart Harbor containers to apply the new certificates:

       #sudo docker-compose down -v

       #sudo docker-compose up -d

 9. Verify that the Harbor UI is accessible via HTTPS without any certificate errors.