Please note: an Admin level Account with the appropriate permissions is required to access the Services Window.
Overview
If the Netsweeper Webadmin Certificate is going to expire in the near future, You can generate a new one as well as share with your remote servers.
Accessing the WebAdmin SSL Certificate Window
Navigate to Administration > Services and select the localhost button to expand the services.
Select the More Actions button for the WebAdmin Service and choose the WebAdmin SSL Certificate option.
The WebAdmin SSL Certificate window allows you to either upload an externally generated certificate to the Webadmin server, or to generate a new one.
If you are generating a new WebAdmin Certificate, you should see the following success message.
Restarting the WebAdmin Service
Once your certificate has been updated, it is necessary to restart the WebAdmin Service.
This can either be done from the command line or in the Services window.
For an EL6 server the command is:
$ sudo -i service httpd restart
For an EL8 server the commands are:
$ sudo -i systemctl restart webadminctl
$ sudo -i systemctl restart nginx
Copying the new Certificate to Remote Servers
If your deployment has remote servers such as a reporter server, deny page servers, logger servers, the Webadmin certificate and key will need to be copied to each of the remote servers and file permissions and ownership set to match the original permissions on the Webadmin server.
The Webadmin certificate is stored in /etc/pki/tls/certs and the key is in /etc/pki/tls/private
The following steps detail how to copy the certificate file to a temporary directory on the remote host and then log in to that host, sudo to root and then copy the file locally.
The following "scp" command uses the remote proxy IP address192.168.30.143 as an example. You will be prompted for the remote proxy server's admin password. (Note the capital "P" in the scp command "-P 60104" ssh port option)
$ sudo -i scp -P 60104 /etc/pki/tls/certs/localhost.crt admin@192.168.30.143:/tmp
$ sudo -i scp -P 60104 /etc/pki/tls/private/localhost.key admin@192.168.30.143:/tmpLogin to the remote host, make a backup of the old certificate and key then copy the new certificate files to the appropriate directory.
$ sudo -i cp /etc/pki/tls/certs/localhost.crt /etc/pki/tls/certs/localhost_old.crt
$ sudo -i cp /etc/pki/tls/private/localhost.key /etc/pki/tls/private/localhost_old.key
$ sudo -i cp /tmp/localhost.crt /etc/pki/tls/certs/
% sudo -i cp /tmp/localhost.key /etc/pki/tls/private/Verify that the permissions and ownership of the newly copied file match the original file on the Webadmin server. Make any corrections to the file permissions and ownership with the chmod and chown commands.
On the Webadmin server: (Example only - Edited for clarity)
$ sudo -i ls -l /etc/pki/tls/certs/localhost*
-rw-r--r-- 1 root root 2151 Jul 29 10:20 localhost.crt
$ sudo -i ls -l /etc/pki/tls/private/localhost*
-rw-r----- 1 root mysql 3272 Jul 29 10:20 localhost.key
On the destination server:
$ sudo -i chmod 644 /etc/pki/tls/certs/localhost.crt
$ sudo -i chown root:root /etc/pki/tls/certs/localhost.crt
$ sudo -i chmod 640 /etc/pki/tls/private/localhost.key
$ sudo -i chown root:mysql /etc/pki/tls/private/localhost.key
The certificates will not become active on the remote servers until the httpd and nginx services are restarted on each server.
Important: Check the nginx configuration with the nginx -t command before restarting it.
Note: the httpd service might not be running on a remote server if the Webadmin is not configured to be running.
For an EL6 server:
$ sudo -i service httpd restart
For an EL8 server:
$ sudo -i systemctl restart webadminctl
Check the nginx configuration:
$ sudo -i nginx -t
You might see some warnings displayed and then:
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
If there an error, re-check the steps taken to copy the certificate and key files.
If the configuration test is successful, restart nginx:
$ sudo -i systemctl restart nginx
The new Webadmin certificate should now be live on the remote servers.
Additional Information
For information about WebAdmin Certificate Management, please refer to this document
You can find more information about Netsweeper Command Line Tools here.