TVO-4.1
Deployment Guide
TrilioVault Appliance Administration Guide
Admin Guide
Troubleshooting
Change Certificates used by TrilioVault
The following TrilioVault services are providing certificates for secured access to the TrilioVault solution.
Service
Port used
Description
TVault-Config
443
Webservice providing the TrilIoVault Dashboard
Nginx (wlm-api)
8780
provides the VIP for wlm-api service
Nginx (Grafana)
3001
VIP for the dashboard of Grafana service running on TrilIioVault VM
Changing the certificate of TVault-Config and Nginx for Grafana Service
The TVault-Config service and the Nginx Resource for the Grafana Dashboard are using the same certificate.
1
[[email protected] ssl]# cd /etc/tvault/ssl/
2
[[email protected] ssl]# ls -lisa server*
3
577678 0 lrwxrwxrwx 1 root root 8 Jan 21 14:36 server.crt -> TVM1.crt
4
577672 0 lrwxrwxrwx 1 root root 8 Jan 21 14:36 server.key -> TVM1.key
5
1178820 0 lrwxrwxrwx 1 root root 8 Jan 21 14:36 server.pem -> TVM1.pem
Copied!
The certificate used is a symlink to a host-specific certificate. Each TrilioVault VM has its own self-signed certificate by default which is getting recreated every time the TVault-Config service is restarted.
When the certificate for the TVault-Config and Nginx (Grafana) is to be changed to a customer chosen certificate it is required to deactivate the recreation of the certificates upon service restart.
Trilio is planning to change this behavior to make it easier for customers to change the certificate in the future.
- 1.Login into the TrilioVault VM via SSH
- 2.Edit the following file:
/home/stack/myansible/lib/python3.6/site-packages/tvault_configurator/tvault_config_bottle.py - 3.Look for create_ssl_certificates() in the main function
- 4.Comment out create_ssl_certificates()
- 5.Repeat for all nodes of the TrilioVault cluster
The resulting main function will look like this:
1
def main():
2
# configure the networking
3
#create_ssl_certificates()
4
​
5
http_thread = Thread(target=main_http)
6
http_thread.daemon = True # thread dies with the program
7
http_thread.start()
8
​
9
bottle.debug(True)
10
srv = SSLWSGIRefServer(host='::', port=443)
11
bottle.run(server=srv, app=app, quiet=False, reloader=False)
Copied!
Afterward, the certificates can be replaced manually by overwriting the files.
Once the certificates have been replaced by the desired ones restart the TVault-Config service and the Nginx pcs resource.
1
[[email protected] ~]# systemctl restart tvault-config
2
[[email protected] ~]# pcs resource restart lb_nginx-clone
3
lb_nginx-clone successfully restarted
Copied!
Changing the certificate used by Nginx for wlm-api service
The certificate provided by the Nginx for the wlm-api service is set during configuration when HTTPS endpoints are configured for the TrilioVault appliance.
This certificate is provided to the end-user or Openstack every time an API call to the TrilioVault solution is sent.
To change the certificate through the configurator make sure to create HTTPS endpoints and upload the certificate and key using the advanced options of the configurator.
Setting HTTPS at the advanced options
The certificates can be changed manually if necessary.
They are located under
/opt/stack/data/cert/1
[[email protected] ~]# cd /opt/stack/data/cert/
2
[[email protected] cert]# ls -lisa workloadmgr*
3
577678 0 lrwxrwxrwx 1 root root 8 Jan 21 14:36 workloadmgr.crt
4
577672 0 lrwxrwxrwx 1 root root 8 Jan 21 14:36 workloadmgr.key
Copied!
These certificates can be replaced manually and the Nginx resource restarted afterward.
1
[[email protected] ~]# pcs resource restart lb_nginx-clone
2
lb_nginx-clone successfully restarted
Copied!
TrilioVault Appliance Administration Guide - Previous
Download TrilioVault logs
Next - TrilioVault Appliance Administration Guide
Restart TrilioVault Services
Last modified 10mo ago