Creating the SSHepherd® C3 Server SSL Certificate

---

Applies to SSHepherd 2.0

The C3 server needs a TLS certificate for its host name. You can let the installer get one from Let’s Encrypt, or use your own.

Quick start: use Let’s Encrypt

Install the C3 server with the letsencrypt option. See Installing the C3 Server. Let’s Encrypt creates the certificate, and cert-manager in the cluster renews it automatically.

To use Let’s Encrypt, the C3 server must be reachable from the internet on ports 80 and 443, and public DNS must point the host name to it.

If you have your own certificate, continue below to check it and prepare it.

If you have an existing domain and certificate

The installer needs:

• A certificate file in PEM format, with no password. It must include any intermediate certificates.
• A key file in PEM format, with no password.

Verify your certificate

Run this command, replacing mycert.pem with your certificate file:

openssl verify mycert.pem

If the command returns an error like the one below, you need to add the intermediate certificates to your certificate file:

CN = mydomain.com
error 20 at 0 depth lookup: unable to get local issuer certificate
error mycert.pem: verification failed

Most certificate issuers provide a bundle file, usually with “bundle” in its name. Add its contents to your certificate file.

Combine certificate files

cat mycert.pem CA_Bundle.pem > combined.pem

To check the combined file:

openssl verify -untrusted <( { openssl x509 >/dev/null; cat; } < combined.pem ) <(openssl x509 < combined.pem)

If the file is correct, the command returns something like:

/dev/fd/62: OK

Use combined.pem as your certificate file when you install the C3 server.

Remove the password from a key

openssl rsa -in my-cert.key -out my-cert-unencrypted.key

See the certificate the server is using

In the Administrator Console, go to Settings → Certificates. It shows the certificate the C3 server currently presents. The System Status page shows how many days remain before the cluster certificate expires.

You can’t upload a certificate from the console. To change it, use the steps below.

Replace the certificate

Use this when your certificate is about to expire, or if you installed with a certificate that clients don’t accept.

You need your C3 server’s namespace, sshepherd-<label>, where <label> is the first part of the host name.

MicroK8s:

microk8s kubectl -n sshepherd-<label> delete secret aks-ingress-tls
microk8s kubectl -n sshepherd-<label> create secret tls aks-ingress-tls --key <unencrypted key file> --cert <crt file>

Azure AKS: run the same commands with kubectl instead of microk8s kubectl.

Note: On servers installed with Let’s Encrypt, the certificate is stored in the secret aks-ingress-tls-sshepherd-<label> and renewed automatically. Don’t replace it by hand.