...
...
Purpose
This article provides the steps required to provide your own certifications to your SoftNAS instance.
Symptoms
An SSL certificate is necessary for more than just distributing the public key
...
. If it is signed by a trusted third-party, it verifies the identity of the server so clients know they aren’t sending their information (encrypted or not) to the wrong person.
...
| Info | ||
|---|---|---|
|
...
|
...
| |
| It is a certificate that is signed by itself rather than a trusted third party. This is not a good idea |
...
| for most business use cases. You will |
...
| almost never want to use a self-signed certificate on a public |
...
| Apache server that requires anonymous visitors to connect to your site because they could easily become a victim of a man-in-the-middle attack. |
...
| Info | ||
|---|---|---|
| ||
|
...
|
...
|
...
|
...
|
...
|
| Info | ||
|---|---|---|
| ||
In other words, when deploying your SoftNAS server into an enterprise use case, it may be required (or at least strongly recommended) that you switch the default self-signed certifications for your own enterprise certifications. |
Purpose
This article provides the steps required to provide your own certifications to your SoftNAS instance.
Resolution
If you want to send or receive messages signed by root authorities and these authorities are not installed on the server, you must add a trusted root certificate manually.
Use the following steps to add or remove trusted root certificates to/from a server:
...
Take a backup of the existing certificate and key files
...
| borderColor | black |
|---|---|
| bgColor | #f0f0f0 |
| borderStyle | solid |
...
using the following commands:
Code Block language bash theme Eclipse linenumbers true mv /etc/pki/tls/certs/ca.crt /etc/pki/tls/certs/
...
cat.crt-old
...
mv /etc/pki/tls/private/ca.key /etc/pki/tls/private/ca.key-old
...
Upload the SSL certificate and key file using any preferred SSH client to the
...
SoftNAS node and copy the newly uploaded
...
certificate and
...
key files to the
...
| borderColor | black |
|---|---|
| bgColor | #f0f0f0 |
| borderStyle | solid |
...
correct path using the following commands:
Code Block language bash theme Eclipse linenumbers true cp <new>.crt /etc/pki/tls/certs/ca.crt
...
cp
...
<new>.key /etc/pki/tls/private/ca.key
...
Ensure that the ca.
...
crt file has the
...
| borderColor | black |
|---|---|
| bgColor | #f0f0f0 |
| borderStyle | solid |
...
correct permissions of 644 with root ownership using the following commands:
Code Block language bash theme Eclipse linenumbers true chown root:root /etc/pki/tls/certs/ca.crt
...
chmod 644 /etc/pki/tls/
...
certs/ca.
...
crt
Ensure that the ca.key file has the correct permissions of 600 with root ownership using the following commands:
Code Block language bash theme Eclipse linenumbers true chown root:root /etc/pki/tls/
...
private/ca.
...
key chmod 600 /etc/pki/tls/private/ca.key
Once the new certificates and keys are in
...
the correct place, check the Nginx
...
configuration file and restart the service
...
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
# nginx -t # systemctl restart nginx |
Notes/Additional Info:
...
using the following commands:
Code Block language bash theme Eclipse linenumbers true nginx -t systemctl restart nginx
| Note |
|---|
Changing the keys will deactivate replication so it is HIGHLY recommended to add the certificates |
...
BEFORE configuring replication to avoid any SnapReplicate™ interruption |
...
Execute the following command on both the target and source node and erase the ssh fingerprints:
...
| borderColor | black |
|---|---|
| bgColor | #f0f0f0 |
| titleBGColor | #f0f0f0 |
| borderStyle | solid |
...
. |
Change Keys after Configuring SnapReplicate™
Erase the SSH fingerprints by using the following command:
Code Block language bash theme Eclipse sed -I '/<OTHER-NODE-IP-
...
ADDRESS>/d' .ssh/known_hosts
...
Add a new set of fingerprints
...
by using the following command:
...
Code Block
...
language
...
bash
...
theme Eclipse ssh-keyscan
...
<OTHER-NODE-IP-
...
Related articles
| Filter by label (Content by label) | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
| hidden | true |
|---|
...
ADDRESS> >> .ssh/known_hosts
- Log into the SoftNAS Web UI (StorageCenter) on both instances and try to activate HA again.
...
| Info |
|---|
If you continue to experience issues, please contact Buurst Support for further assistance. |