Automatic Renewal of the EJBCA Server Certificate¶
Overview¶
The EJBCA server certificate (ejbca-tls-cert) is issued by the
system-local-ca ClusterIssuer and managed by cert-manager.
cert-manager automatically renews the certificate 30 days before expiration
(renewBefore: 720h) and updates the associated Kubernetes secret.
After cert-manager renews the certificate and updates
the associated Kubernetes secret, the EJBCA pod must be restarted to reload the
updated TLS certificate used by the httpd sidecar. The Stakater Reloader
application (app-reloader) automates this process.
Deployed as a separate platform application, app-reloader detects updates
to the certificate secret and automatically restarts the EJBCA pod, allowing
the httpd sidecar to load the renewed certificate.
Prerequisites
Automatic pod restart requires the app-reloader platform application.
Upload and apply the app-reloader application:
~(keystone_admin)]$ system application-upload /path/to/reloader-<version>.tgz
~(keystone_admin)]$ system application-apply reloader
Verify that the application is running:
~(keystone_admin)]$ system application-show reloader
~(keystone_admin)]$ kubectl get pods -n reloader
Manually Reload the Renewed Certificate¶
Note
When app-reloader is installed, no manual intervention is required after certificate renewal.
If app-reloader is not deployed, cert-manager still renews the certificate
and updates the Kubernetes secret, but the EJBCA pod is not automatically
restarted. To load the renewed certificate, manually restart the pod:
~(keystone_admin)]$ kubectl rollout restart statefulset ejbca -n ejbca
Related Information
