Specifying trust stores for adding a third-party CA certificate

Last Updated : Jul 11, 2022 |
Prolog information
Metadata
Keywords:
For the third-party CA certificate, you can use:
  • Default set of trust stores for externally facing interfaces.
  • Specific trust stores for external and internal interfaces.
    If you are using specific trust stores for external and internal interfaces, then perform this procedure before importing the third-party CA certificate. Avaya recommends using this procedure to specify trust stores if you manually specified identity certificates for external and internal interfaces, before generating CSRs.
    Note:
    Do not use this procedure if you are using default set of trust stores for externally facing interfaces.
  1. Create a file called trust-store-serviceId-list-file. Copy the trust store service IDs listed below into this file and save it.
    ADDITIONAL INFORMATION:
    certmgmt-agent-certificate-document-trustedcert-cms
    alarming-service-certificate-alarmingdb-trustedcert-primary
    orca-itd-agent-by-routing-service-measure-proc-arbactruststore
    platform-kubernetes--kubernetes.pem-platform-kubernetes--kubernetes.pem_trustedcert
    mstrsrv-service-certificate-mstr-mstrsrv-trustedcert
    rbac-service-certificate-default-rbac-service-trustedcert
    pgo-license-certificate-cacert1
    ingressgateway-certificate-default-ingressgateway-trustedcert
    async-aggregator-interface-asyncaggregatortrustore
    platform-kubernetes--kube-scheduler.pem-platform-kubernetes--kube-scheduler.pem_trustedcert
    common-services-authdb-certificate-authdb-replica-truststore
    platform-kubernetes--admin.pem-platform-kubernetes--admin.pem_trustedcert
    orca-database-rest-databaseresttruststore
    logelasticsearch-certificate-default-logelasticsearch-mtls-trustedcert
    orca-itd-agent-not-ready-reason-code-measure-proc-arbactruststore
    orca-streams-data-publisher-orcapublishertruststore
    prometheus-operator-certificate-default-common-services-prometheus-operator-trustedcert
    clusterhc2-certificate-default-common-services-clusterhc-trustedcert
    prometheus-node-exporter-certificate-default-common-services-prometheus-node-exporter-trustedcert
    eventing-kafka-cp-zookeeper-kafkaconnecttruststore
    orca-streams-rest-streamsresttruststore
    orca-cdr-measure-proc-arbactruststore
    orca-itd-agent-by-account-measure-proc-arbactruststore
    orca-itd-routing-service-group-measure-proc-arbactruststore
    cmonitor-service-certificate-default-common-services-cmonitor-trustedcert
    alarming-service-certificate-alarmingdb-trustedcert-replication
    orca-itd-agent-measures-proc-arbactruststore
    platform-kubernetes--kube-controller-manager.pem-platform-kubernetes--kube-controller-manager.pem_trustedcert
    prometheus-alertmanager-certificate-default-common-services-prometheus-alertmanager-trustedcert
    fluentd-certificate-default-Fluentd-trustedcert
    orca-vdn-measure-proc-arbactruststore
    orca-breeze-authentication-streamsresttruststore
    async-oceana-adapter-asyncoceanatrustore
    mstrweb-service-certificate-mstr-mstrweb-trustedcert
    eventing-istio-sidecar-eventing-istio-sidecar-trustcerts
    orca-itd-site-measure-proc-arbactruststore
    eventing-kafka-cp-kafka-connect-kafkaconnecttruststore
    platform-kubernetes--service-account.pem-platform-kubernetes--service-account.pem_trustedcert
    ingressgateway-mesh-default-ingress-mesh-trustedcert
    common-services-auth-http-service-certificate-default-common-services-auth-http-trustedcert
    eventing-kafka-cp-kafka-kafkatruststore
    alarming-service-certificate-default-alarming-service-mtls-trustedcert
    orca-open-interface-kafka-interface-orca-open-interface-kafka-interface-trust-store
    certmgmt-agent-certificate-document-trustedcert-db
    eventing-kafka-cp-schema-registry-kafkaconnecttruststore
    orca-interval-controller-arbactruststore
    orca-ref-input-adaptor-arbactruststore
    eventing-kafka-eventing-operator-eventingoperatortruststore
    common-services-authdb-certificate-authdb-primary-truststore
    orca-itd-agent-by-routing-service-measure-proc-arbactruststore
    orca-trace-measure-proc-arbactruststore
    egressgateway-certificate-default-egressgateway-trustedcert
    pilot-mesh-default-pilot-mesh-trustedcert
    eventing-kafka-topic-operator-kafkaconnecttruststore
    prometheus-certificate-default-common-services-prometheus-trustedcert
    eventing-operator-istio-sidecar-eventing-istio-sidecar-trustcerts
    kibana-certificate-default-kibana-logging-service-mtls-trustedcert
    orca-jrnl-agent-login-logout-measure-proc-arbactruststore
    egressgateway-mesh-default-egress-mesh-trustedcert
    orca-itd-agent-group-measure-proc-arbactruststore
    ccm-identity.pfx-ccm-identity.pfx_trustedcert
    async-file-transfer-filetransfertrustore
    default-mesh-default-mesh-trustedcert
    certmgmt-agent-certificate-document-trustedcert-cma
    orca-admin-data-service-arbactruststore
    platform-kubernetes--kube-proxy.pem-platform-kubernetes--kube-proxy.pem_trustedcert
    kube-state-metrics-certificate-default-common-services-kube-state-metrics-trustedcert
    common-services-jwks-store-jwksstoretruststore
    grafana-certificate-default-common-services-grafana-trustedcert
Next steps
Import third-party CA certificates and identity certificates simultaneously, run the following command:ccm release cert-manager third-party-certs --add-certs --list-file \
trust-store-serviceId-list-file --ca-cert-file <third-party-CA_PEM_filename> \
--id-cert-dir /home/<customer_account>/id-cert-filesAlternatively, import third-party CA certificates separately, run the following command:ccm release cert-manager third-party-certs --add-trustcert --list-file \
trust-store-serviceId-list-file --ca-cert-file <third-party-CA_PEM_filename>