GitHub user fnavidan added a comment to the discussion: [URGENT] Libvirt
Certificates Expired
I was able to recover the KVM host successfully using following steps.
1. Change default certificate validity period to 10 years:
Global Settings -> ca.framework.cert.validity.period: Set to 3650 (~10
years)
2. Generate CSR:
On KVM host run:
# /usr/share/cloudstack-common/scripts/util/keystore-setup \
/etc/cloudstack/agent/agent.properties \
/etc/cloudstack/agent/cloud.jks \
<KEYSTORE_PASSWORD> \
3650 \
/etc/cloudstack/agent/cloud.csr
3. Issue certificate using cmk
- On management server run:
# cmk issue certificate \
domain=<HOST FQDN> \
csr="$(cat /etc/cloudstack/agent/cloud.csr)" \
duration=3650
- Save "certificates" value returned in json format into
/etc/cloudstack/agent/cloud.crt on KVM host.
- Replace literal "\n" in json value with new line using:
# printf "%b" "$(cat /etc/cloudstack/agent/cloud.crt)" >
/etc/cloudstack/agent/cloud.crt
4. Import certificate to keystore.
On KVM host run:
# /usr/share/cloudstack-common/scripts/util/keystore-cert-import \
/etc/cloudstack/agent/agent.properties \
"<KEYSTORE_PASSWORD>" \
/etc/cloudstack/agent/cloud.jks \
ssh \
/etc/cloudstack/agent/cloud.crt \
"$(cat /etc/cloudstack/agent/cloud.crt | sed ':a;N;$!ba;s/\n/^/g;s/
/~/g')" \
/etc/cloudstack/agent/cloud.ca.crt \
"$(cat /etc/cloudstack/agent/cloud.ca.crt | sed ':a;N;$!ba;s/\n/^/g;s/
/~/g')" \
/etc/cloudstack/agent/cloud.key \
""
5. Restart libvirtd and cloudstack-agent
# systemctl restart libvirtd
# systemctl restart cloudstack-agent
GitHub link:
https://github.com/apache/cloudstack/discussions/13576#discussioncomment-17588912
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
