SUSE Support

Here When You Need Us

How to recreate a SMT server CA and server certificate

This document (7006024) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Subscription Management tool
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Server 10
 

Situation

It is usually unnecessary to recreate the CA and server certificate. If you think your CA or server certificate are not functioning as expected, you may need to recreate them. This TID explains how.

Resolution

Delete the old CA
  1. Since YaST does not allow to delete the existing CA as long it has not expired, we have to delete the related files manually.
  2. Open up a shell and change to /var/lib/CAM and move the directory of the existing CA to /tmp/, e.g. by executing "mv YaST_Default_CA /tmp/". Attention: Do not move or delete the ".cas" directory. Do not move or delete the file openssl.cnf.tmpl either, as it's a template for YaST CA Management.

Create root CA
  1. From the root shell start 'yast2 ca_mgm'.
  2. Select 'Create Root CA'.
  3. For "CA Name" and "Common Name" enter "YaST_Default_CA". Please note not to use the server name or server FQDN in here, since this would complicate later error analysis!
  4. Enter the email address of the issuer (and select "add") and enter optional information such as organization, unit, locality, state and country.
  5. Select "Next".
  6. Choose the password, length of the key and its validity.
  7. Select "Next" to see an overview about the CA.
  8. Select "Create" to create the CA.

Create server certificate
  1. Select the newly created CA in the YaST2 CA management module.
  2. Press "Enter CA".
  3. Enter the CA password.
  4. Select the Certificates tab.
  5. Click on "Add" and choose Server Certificate.
  6. Provide the requested data:
  7. For Common Name put in the fully qualified domain name of the server (FQDN) of the server, for example "smt-server.example.net". This is mandatory!  NOTE: If you are recreating the CA because of a server name or domain change for the SMT server do not forget to also change the url setting in the /etc/smt.conf file.
  8. Add an valid email address of the server administrator and press "Add".
  9. Press "Next".
  10. Here it is possible to either use the CA password for the server certificate or a different one. Also key length and validity may be changed.
  11. Add DNS hostname and IP address to Subject Alternative Name. Adding the IP is optional, but the DNS hostname (as the FQDN) must be added, else the certificate will not accepted on all implementations. Adding the IP address has the advantage that clients also could use IP to connect to SMT server, but as IP might change, DNS hostname should be preferred . Add additional DNS hostnames and IP addresses of the SMT server if needed.
    • Select 'Advanced Options'.
    • Select 'Subject Alt Name' (not to be confused with Issuer Alt Name!!).
    • Select 'Add'.
    • Choose 'DNS' and put int the hostname (FQDN) of the server
    • Choose 'IP' and put in the IP address of the server.
  12. Select 'Next' to get to an overview over the certificate.
  13. Select 'Create' to create the server certificate.

Export the certificate as common server certificate, so that the http server apache uses it
  1. On the certificates tab locate the "Export" button.
  2. Select "Export as common server certificate".
  3. Enter the password that was chosen for the server certificate.
  4. A message "Certificate has been written as common server certificate" will be displayed.

Export the CA certificate to the smt.crt file
  1. In the YaST2 CA management module change to the "Description" tab and select "Advanced / Export to File".
  2. Select "Only the Certificate in PEM Format" and enter "/srv/www/htdocs/smt.crt" as the filename.
  3. Select "Ok" to export the file.
  4. Leave YaST.

Restart SMT
  1. Restart the smt server by entering "rcsmt restart" into the root shell. This will also restart the http server apache on SMT 11/10, so that apache uses the new certificate.

NOTE: on SMT 12 SPx servers run

      systemctl restart smt.service

      and

      systemctl restart apache2.service

Import the newly created CA to the SMT clients
 
  1. Execute "clientSetup4SMT.sh --host smt-server.example.net" (adjust the FQDN to your SMT server) to import the new CA to the SMT clients and to make the clients to trust the new CA. On SLE 11 clients you can alternatively use the "yast2 inst_suse_register" module (select "Advanced" and follow the instructions).
  2. Execute "suse_register -L /root/.suse_register.log" to register the client against the SMT server.

 

Additional Information

Please note: if the server certificate of the SMT system has expired (by default this happens after one year), you don't need to re-create the CA. Just create a new server certificate, export it as common server certificate and restart the smt service as described above. There is no need to make any changes to the clients either as they will automatically accept the new server certificate because they already trust the Root CA.

Please find more documentation on Certificates in the SMT 11 Documentation (Tool Guide), Chapter 7.3, Server Certificates.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7006024
  • Creation Date: 18-May-2010
  • Modified Date:21-Dec-2021
    • Subscription Management Tool
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

tick icon

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

tick icon

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

tick icon

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.