Overview of Certificate Rotation
Page last updated:
This topic provides an overview of rotating certificate authorities (CAs) and leaf certificates in Pivotal Platform.
The Ops Manager API manages and lists internal CAs and leaf certificates that enable Pivotal Platform components to communicate with each other securely using TLS. It can also list certificates used externally, such as SAML certificates that authenticate to an external identity provider (IDP).
For more information about the CAs and leaf certificates visible to the Ops Manager API, see Certificate Types.
Rotate CAs and leaf certificates before they expire to avoid downtime for your deployment. To rotate certificates in Pivotal Platform, first check the expiration dates of all certificates. Then, based on the types of certificates that expire soon, follow a certificate rotation procedure to replace expiring certificates and deploy BOSH to apply changes.
Before determining which certificate rotation procedure to follow, you must determine:
- Which types of CAs and leaf certificates exist in your deployment.
- Which CAs and leaf certificates are due to expire soon.
- Whether customer-provided CAs exist in your deployment.
To check the types and expiration dates of your certificates, see Checking Expiration Dates and Certificate Types.
Warning: If customer-provided CAs exist in your deployment, you must do an additional procedure to successfully rotate. To see if you have customer-provided CAs and rotate them successfully, see [Rotating Certificates with Customer-Provided CAs](rotate-customer-provided-cas.html).
The topics listed in this section explain how to rotate certificates in Pivotal Platform, including the Ops Manager root CA, BOSH NATS CA, CAs stored in CredHub, and leaf certificates. There are different rotation procedures for each type of certificate that requires rotation.
Warning: The rotation procedures described in the topics below do not work if the certificates have already expired. If the certificates have expired, contact Pivotal Support for guidance.
To rotate certificates, follow one of these procedures:
To rotate non-rotatable certificates, contact Pivotal Support.
To rotate CAs and leaf certificates stored in Ops Manager and CredHub, see Rotating CAs and Leaf Certificates. This procedure also rotates the BOSH NATS CA.
To rotate non-configurable leaf certificates, but not the Ops Manager root CA or BOSH NATS CA, see Rotating Non-Configurable Leaf Certificates.
To rotate configurable leaf certificates, but not the Ops Manager root CA or BOSH NATS CA, see Rotating Configurable Leaf Certificates.
Other certificates that the Ops Manager API does not rotate include:
Certificates managed by CredHub, including the Services TLS CA. To rotate CredHub-managed certificates, see Advanced Certificate Rotation with CredHub Maestro.
IDP SAML certificates. To rotate IDP SAML certificates, see Rotating Identity Provider SAML Certificates.
IPsec certificates. To rotate IPsec certificates, see Rotating IPsec Certificates in the Pivotal IPsec documentation.
Certificates for any products that you deploy manually with BOSH. To rotate these certificates, you must re-deploy the BOSH release and re-create its VMs using the BOSH CLI.