Manually replacing the authorization certificates in the breeze-security secret

Last Updated : Feb 17, 2026 |
Prolog information
Metadata
Keywords:
You need to add the authorization certificates to the new directory and create a new secret using the content of the old secret.
Recreating the secret requires the secret content input in cleartext. If the corresponding information is not available in the documentation, you need to decode all token values of the existing secret from base64 to cleartext. Note the output to prepare for the next steps.
Note:
This is a manual procedure that involves kubectl commands and requires familiarity with the Avaya Analytics™ environment. Alternatively you can perform the procedures from Deploying Avaya Analytics™ for Avaya Oceana®. For more information, see Replacing the authorization certificates in the breeze-security secret.
Before you begin
Backup your existing certificates directory. For example, cp -r /home/cust/ssl /home/cust/ssl_backup.
  1. To create a new directory and copy the content from the existing directory, run the following commands:
    ADDITIONAL INFORMATION: mkdir /home/cust/ssl_new
    cp /home/cust/ssl/clienttruststore.jks /home/cust/ssl_new
    cp /home/cust/ssl/clientkeystore.jks /home/cust/ssl_new
    You need to create a new directory to store certificate files and copy the content from the existing certificate directory.
  2. To change to the new directory and create a backup of the existing secret, run the following commands:
    ADDITIONAL INFORMATION: cd /home/cust/ssl_new
    kubectl get secret breeze-security -o yaml > breeze-security.backup
  3. To pull the new certificates from SMRG and Avaya Breeze® Avaya Oceana® Cluster 2 nodes, run the following commands:
    ADDITIONAL INFORMATION: echo -n | openssl s_client -connect <SMGR_IP_ADDRESS>:443 | sed -ne '/-
    BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <SMGR_IP_ADDRESS>.crt
    echo -n | openssl s_client -connect 
    <BREEZE_1_SIP_ENTITY_IP_ADDRESS>:443 | sed -ne '/-BEGIN CERTIFICATE-
    /,/-END CERTIFICATE-/p' > <BREEZE_1_SIP_ENTITY_IP_ADDRESS>.crt
    echo -n | openssl s_client -connect 
    <BREEZE_2_SIP_ENTITY_IP_ADDRESS>:443 | sed -ne '/-BEGIN CERTIFICATE-
    /,/-END CERTIFICATE-/p' > <BREEZE_2_SIP_ENTITY_IP_ADDRESS>.crt
    ADDITIONAL INFORMATION:
    If there is no Avaya Oceana® Cluster 2, run the commands for three Avaya Oceana® Cluster 1 nodes.
  4. In the existing certificate directory, compare the content of the CRT files with the corresponding files.
  5. To delete the changed certificates from clienttruststore.jks, run the following commands:
    ADDITIONAL INFORMATION: keytool -delete -alias SMGR_CRT -keystore clienttruststore.jks
    keytool -delete -alias BREEZE_1 -keystore clienttruststore.jks
    keytool -delete -alias BREEZE_2 -keystore clienttruststore.jks
  6. To add new certificates to clienttruststore.jks, run the following commands:
    ADDITIONAL INFORMATION: keytool -import -noprompt -alias SMGR_CRT -keystore
    clienttruststore.jks -file <SMGR_IP_ADDRESS>.crt
    keytool -import -noprompt -alias BREEZE_1 -keystore 
    clienttruststore.jks -file <BREEZE_1_SIP_ENTITY_IP_ADDRESS>.crt
    keytool -import -noprompt -alias BREEZE_2 -keystore 
    clienttruststore.jks -file <BREEZE_2_SIP_ENTITY_IP_ADDRESS>.crt
  7. For each node, export authentication services identity certificates from SMGR:
    1. Go to ServicesInventoryManage Elements.
    2. Select the Avaya Breeze® node with installed authentication services.
    3. Click More ActionsManage Identity Certificates.
    4. Click AuthorizationExport.
    5. Rename the exported file to AvayaBreezeNode1.pem.
      ADDITIONAL INFORMATION:
      Name files according to the node number. For example, AvayaBreezeNode2.pem, AvayaBreezeNode3.pem.
  8. Copy the files to the certificate folder on Cluster Control Manager.
  9. To convert the certificate files into binary format, run the following commands:
    ADDITIONAL INFORMATION: openssl x509 -outform der -in AvayaBreezeNode1.pem -out
    AvayaBreezeNode1.der
    openssl x509 -outform der -in AvayaBreezeNode2.pem -out 
    AvayaBreezeNode2.der
  10. To create a new Avaya Breeze® certificate store, run the following commands:
    ADDITIONAL INFORMATION:
    keytool -import -alias AvayaBreezeNode1 -keystore BreezeCerts -file
    AvayaBreezeNode1.der
    keytool -import -alias AvayaBreezeNode2 -keystore BreezeCerts -file
    AvayaBreezeNode2.der
  11. To list the content of the existing secret, run the following command:
    ADDITIONAL INFORMATION:
    kubectl get secret breeze-security -o yaml
    ADDITIONAL INFORMATION:
    The following is a sample output of the command:
    server1breeze1TokenEndpoint: 
    aHR0cHM6Ly8xMDAuOTYuOTIuMTEzOjk0NDMvc2VydmljZXMvQXV0aG9yaXphdGlvblNlcnZpY2UvdG9rZW4=
    server1breeze2TokenEndpoint: 
    aHR0cHM6Ly8xMDAuOTYuOTIuMTE1Ojk0NDMvc2VydmljZXMvQXV0aG9yaXphdGlvblNlcnZpY2UvdG9rZW4=
    server1clientKey: UXRuZTdfM1dUc0txUnZOdHVlSDFtdw==
    server2breeze1TokenEndpoint: ""
    server2breeze2TokenEndpoint: ""
    server2clientKey: ""
    smgrPemAlias: YXZheWFicmVlemVub2RlMSxhdmF5YWJyZWV6ZW5vZGUy
    storePwd: bXlwYXNzd29yZA==
  12. Optional: To decode the token values from step 11 from base64 to clear text, run the following command echo -n 'token values' | base64 -d
    ADDITIONAL INFORMATION:
    For example, echo -n 'bXlwYXNzd29yZA==' | base64 -d, where bXlwYXNzd29yZA is the store password.
    You can also use the corresponding information from the documentation if it is available.
  13. To delete the existing secret, run the following command:
    ADDITIONAL INFORMATION:
    kubectl delete secret breeze-security
    ADDITIONAL INFORMATION:
    Ensure you have made a backup of the existing secret at the beginning of this procedure.
  14. Create a new secret using the parameters of the old secret.
    ADDITIONAL INFORMATION:
    The following is a sample command:kubectl create secret generic breeze-security --from-
    literal=storePwd=<passwd> --from-file=/home/cust/ssl_new/clientkeystore.jks -
    --from-file=/home/cust/ssl_new/clienttruststore.jks --from-
    literal=server1clientKey=<server1clientkey> --from-
    literal=server1breeze1TokenEndpoint=<server1_breeze1_token_endpoint> --from-
    literal=server1breeze2TokenEndpoint=<server1_breeze2_token_endpoint> --from-
    file=/home/cust/ssl_new/BreezeCerts --from-
    literal=smgrPemAlias=<smgrPemAlias>
  15. Restart the following pods:
    ADDITIONAL INFORMATION:
    • breeze-auth
    • streams-rest
    • data-publisher
    • open-interface
    You can restart the pods manually or using the Analytics Administration script. For more information, see Restarting a specific pod.
  16. Clean up the installation directories.
    ADDITIONAL INFORMATION:
    You can copy the new keystore files to the original certificate directory and remove the new directory.
  17. To restore the original secret from the backup, run the following command:
    ADDITIONAL INFORMATION:
    kubectl apply -f breeze-security.backup