Maintaining Certificates

Certificates and their Certificate Authority (CA) have an expiration date; therefore, they need to be renewed prior to expiring in order for the cluster to operate properly.

To better understand the CAs in the cluster, see Securing External Communication with the RE Certificate

In this section, $<CDF_HOME> refers to:
On-premises: /opt/arcsight/kubernetes
Cloud: $<OMT-deployer path>

Viewing the CA Validity Dates
Renewing Internal CAs
Renewing External CAs

Viewing the CA Validity Dates

Review the content below for information about viewing CA validity dates.

Internal CA (RIC and RID CA) is reported in the beginning of each kube-status run with time/date and days remaining till expiration.
To view the external CA (RE CA) validity dates, execute the following command on the primary master node. Or, if deployed to the Cloud, execute the command on the jump host or bastion.
```
${CDF_HOME}/scripts/cdf-updateRE.sh read | openssl x509 -noout -issuer -subject -dates
```

Renewing Internal CAs

This information for is for pod communication within the cluster and not for certificates used for external pod communication.

To check if your Internal Certificate Authority is close to expiration, login into the OMT Management Portal, which will show a warning if less than 30 days are left till expiration.

Alternatively, you can run the kube-status.sh script from /opt/arcsight/kubernetes/bin (installation path by default). Expiration date will be reported as the first line in the script output.

To renew internal CAs and dependent certificates:

Execute renewCert. This action also distributes the renewed CA between the nodes.

${CDF_HOME}/scripts/renewCert --renew -t internal -V 730

Follow the on-screen prompts to:
1. Generate new certificates.
2. Distribute them between the nodes using scp.
3. Apply certificates by restarting nodes one by one.

Renewing External CAs

This procedure updates the certificates used by the OMT Management Portal as well as ArcSight capabilities. Changing the certificate by way of the OMT Management Portal, Administration > Certificate, only changes the certificate used by the OMT Management Portal.

To renew external CAs, request that your PKI team generates an intermediate certificate and matching key. Be sure to obtain any higher root certificate authority or a whole chain if more that one level used.

If you cannot get a key from your PKI team, see Using an RE External Communication Certificate Signed by Your Trusted Certificate Authority.

Execute cdf-updateRE.sh.

${CDF_HOME}/scripts/cdf-updateRE.sh write --re-key={New Intermediate Key Name}.pem --re-crt={New Intermediate Certificate Name}.crt

If your intermediate certificate is signed by a higher root certificate authority, provide a chain of root CA certificate and intermediate certificate concatenated in one file (keeping the headers) to the "re-crt" parameter. Make sure the intermediate certificate is first in the file, and the root CA certificate is last in the file.

Pods of the deployed ArcSight capabilities that perform external communication continue to use the certificates generated by the platform on the pod start up until the pod is restarted.

To understand the pods that perform external communication, see Understanding Labels and Pods.

Renewing External Certificate of Management Portal and Fusion Single-Sign-On Portal

To renew the certificate for portals:

Log in to database node1.
Follow these steps to stop the Kafka Scheduler and Watchdog:
1. Change to the database tools directory:
```
cd /opt/arcsight-db-tools
```
2. Stop the Kafka Scheduler:
```
./kafka_scheduler stop
```
3. Disable watchdog:
```
scripts/watchdog.sh disable
```

Restart the ArcSight pods:

kubectl delete pods --all -n $(kubectl get namespaces --no-headers -o custom-columns=":metadata.name" | grep arcsight-installer)

Run this command to update the nginx certificate:
```
${CDF_HOME}/scripts/cdf-updateRE.sh renewPortals
```
The second command generates the nginx certificate and updates the nginx-invesitgate-secret and nginx-default-secret.
Continue to the next step to update the database certificates: Configuring the ArcSight Database to Use the Updated RE External Communication Certificate.