LATEST VERSION: 1.9 - CHANGELOG
IPsec Add-On for PCF v1.7

Rotating Active IPsec Certificates

Page last updated:

This topic describes the process Pivotal recommends to increase deployment security by rotating certificates in the IPsec manifest.

Why You Need to Rotate Credentials

These are common reasons for rotating credentials:

  • Your organizational security policy may specify how often you should apply these changes.

  • Your certificates are going to expire. To find the expiration dates on your certificates, see Checking Certificate Dates.

About the Procedures

There are two procedures for certificate rotation described in this topic:

  • Procedure 1 describes rotating the following certificates specified in your IPsec manifest:

    • The instance certificate and instance private key
      This procedure requires updating BOSH. It does not include rotating the certificate authority (CA) certificate.
  • Procedure 2 describes rotating your CA certificate in addition to your instance certificate and instance private key. This procedure requires updating BOSH three times.

Note: The rolling deploys during these procedures result in minimal deployment downtime.

Procedure 1: Rotate the Instance Certificate and Instance Private Key

Follow the steps below to rotate the instance certificate and instance private key.

  1. Generate a new certificate and use your existing IPsec CA certificate to sign the new certificate.

  2. Update the instance certificate and the private key fields in your ipsec-addon.yml file with new values from the previous step.

  3. Update the runtime config by running one of the following commands:

    • For Ops Manager v1.10 or earlier: bosh update runtime-config PATH_TO_SAVE_THE_RUNTIME_CONFIG
    • For Ops Manager v1.11 or later: bosh2 -e BOSH_ENVIRONMENT update-runtime-config --name=ipsec PATH_TO_SAVE_THE_RUNTIME_CONFIG

    Note: This step results in a few minutes of app downtime.

  4. Navigate to your Ops Manager interface in a browser, and click Apply Changes.

Procedure 2: Rotate the CA Certificate, the Instance Certificate, and Instance Private Key

Follow these steps to rotate the CA certificate, instance certificate, and instance private key.

  1. Generate a new CA certificate.

  2. Append the newly generated CA certificate under the existing certificate as a new yaml list element in your ipsec-addon.yml. For example:

    ca_certificates:
      - |
         -----BEGIN CERTIFICATE-----
         ...
         -----END CERTIFICATE-----
      - |
         -----BEGIN CERTIFICATE-----
         ...
         -----END CERTIFICATE-----
         .
         .
         .
    

  3. Update the runtime config by running one of the following commands:

    • For Ops Manager v1.10 or earlier: bosh update runtime-config PATH_TO_SAVE_THE_RUNTIME_CONFIG
    • For Ops Manager v1.11 or later: bosh2 -e BOSH_ENVIRONMENT update-runtime-config --name=ipsec PATH_TO_SAVE_THE_RUNTIME_CONFIG

    Note: This step results in a few minutes of app downtime.

  4. Navigate to your Ops Manager interface in a browser, and click Apply Changes.

  5. Generate a new certificate and use your new CA certificate to sign the new certificate.

  6. Update the instance certificate and the private key fields in the your ipsec-addon.yml file with new values from above.

  7. Repeat step 3 to update the runtime config.

  8. Navigate to your Ops Manager interface in a browser, and click Apply Changes.

  9. Delete the older CA certificate in the ipsec-addon.yml file.

  10. Repeat step 3 to update the runtime config.

  11. Navigate to your Ops Manager interface in a browser, and click Apply Changes.

Create a pull request or raise an issue on the source for this page in GitHub