Services fail to consume certificates renewed by Certificate Manager service

Last Updated : Dec 08, 2022 |
Prolog information
Metadata
Keywords:

Condition

The Certificate Manager service generates certificates for various services in the cluster that expire in 2 years from initial installation date. Certificate Manager renews these certificates before it expires and make these certificates available to the services. It is up to the services to consume these newly updated certificates. However, some services in the cluster fails to consume these newly updated certificates.

Solution: Renew certificates manually

  1. Login to the Cluster Control Manager as cust after installing the patch.
  2. Identify expiration of currently installed certificates, run the following command:
    ADDITIONAL INFORMATION: renewServiceCertificates --checkExpiration
    STEP RESULT:
    If the renewServiceCertificates tool is not used yet:
    Begin checking Certificate Manager services' certificates expiration!
    Services' certificates were created when the cluster was installed on 04/28/2020
    These certificates will expire 2 years from then on 04/28/2022
    Finished checking Certificate Manager services' certificates expiration!
    If the renewServiceCertificates tool is used:
    Begin checking Certificate Manager services' certificates expiration!
    Services' certificates were renewed on 05/02/2021
    These certificates will expire 2 years from then on 05/02/2023
    Finished checking Certificate Manager services' certificates expiration!
  3. ADDITIONAL INFORMATION: renewServiceCertificates
    ADDITIONAL INFORMATION:
    Note:
    Run this command in maintenance window only before performing an upgrade.
    1. When prompted to confirm that an upgrade/restart will take place after running this command, enter y.
  4. ADDITIONAL INFORMATION: renewServiceCertificates –restartAllServices
    ADDITIONAL INFORMATION:
    Note:
    Run this command in maintenance window.
    1. When prompted, enter y to restart all services.
      STEP RESULT:
      All services are restarted. Services starts using renewed certificates.
  5. Check if the services are restarted, run the following command:
    ADDITIONAL INFORMATION: ccm smoke-test
    ADDITIONAL INFORMATION:
    Note:
    If any of the service pods are not in a running state after an hour, contact Avaya support.