How to recreate a SMT server CA and server certificate

1. Since YaST does not allow to delete the existing CA as long it has not expired, we have to delete the related files manually.
2. Open up a shell and change to /var/lib/CAM and move the directory of the existing CA to /tmp/, e.g. by executing "mv YaST_Default_CA /tmp/". Attention: Do not move or delete the ".cas" directory. Do not move or delete the file openssl.cnf.tmpl either, as it's a template for YaST CA Management.

1. From the root shell start 'yast2 ca_mgm'.
2. Select 'Create Root CA'.
3. For "CA Name" and "Common Name" enter "YaST_Default_CA". Please note not to use the server name or server FQDN in here, since this would complicate later error analysis!
4. Enter the email address of the issuer (and select "add") and enter optional information such as organization, unit, locality, state and country.
5. Select "Next".
6. Choose the password, length of the key and its validity.
7. Select "Next" to see an overview about the CA.
8. Select "Create" to create the CA.

1. Select the newly created CA in the YaST2 CA management module.
2. Press "Enter CA".
3. Enter the CA password.
4. Select the Certificates tab.
5. Click on "Add" and choose Server Certificate.
6. Provide the requested data:
7. For Common Name put in the fully qualified domain name of the server (FQDN) of the server, for example "smt-server.example.net". This is mandatory!  NOTE: If you are recreating the CA because of a server name or domain change for the SMT server do not forget to also change the url setting in the /etc/smt.conf file.
8. Add an valid email address of the server administrator and press "Add".
9. Press "Next".
10. Here it is possible to either use the CA password for the server certificate or a different one. Also key length and validity may be changed.
11. Add DNS hostname and IP address to Subject Alternative Name. Adding the IP is optional, but the DNS hostname (as the FQDN) must be added, else the certificate will not accepted on all implementations. Adding the IP address has the advantage that clients also could use IP to connect to SMT server, but as IP might change, DNS hostname should be preferred . Add additional DNS hostnames and IP addresses of the SMT server if needed.
    • Select 'Advanced Options'.
    • Select 'Subject Alt Name' (not to be confused with Issuer Alt Name!!).
    • Select 'Add'.
    • Choose 'DNS' and put int the hostname (FQDN) of the server
    • Choose 'IP' and put in the IP address of the server.
12. Select 'Next' to get to an overview over the certificate.
13. Select 'Create' to create the server certificate.

1. On the certificates tab locate the "Export" button.
2. Select "Export as common server certificate".
3. Enter the password that was chosen for the server certificate.
4. A message "Certificate has been written as common server certificate" will be displayed.

1. In the YaST2 CA management module change to the "Description" tab and select "Advanced / Export to File".
2. Select "Only the Certificate in PEM Format" and enter "/srv/www/htdocs/smt.crt" as the filename.
3. Select "Ok" to export the file.
4. Leave YaST.

1. Restart the smt server by entering "rcsmt restart" into the root shell. This will also restart the http server apache on SMT 11/10, so that apache uses the new certificate.

NOTE: on SMT 12 SPx servers run

      systemctl restart smt.service

      and

      systemctl restart apache2.service

1. Execute "clientSetup4SMT.sh --host smt-server.example.net" (adjust the FQDN to your SMT server) to import the new CA to the SMT clients and to make the clients to trust the new CA. On SLE 11 clients you can alternatively use the "yast2 inst_suse_register" module (select "Advanced" and follow the instructions).
2. Execute "suse_register -L /root/.suse_register.log" to register the client against the SMT server.