Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 6 Current »

Symptoms

An SSL certificate is necessary for more than just distributing the public key: if it is signed by a trusted third party, it verifies the identity of the server so clients know they aren’t sending their information (encrypted or not) to the wrong person. So what is a self-signed certificate? It is a certificate that is signed by itself rather than a trusted third party. This is not a good idea for most business use cases. You will rarely want to use a self-signed certificate on a public Web server that requires anonymous visitors to connect to your site because they could easily become a victim of a man-in-the-middle attack. There are a limited number of situations in which a self-signed certificate may prove adequate:

  • Self-signed certificates can be used on an Nginx development server. There is no need to spend extra cash buying a trusted certificate when you are just developing or testing an application.
  • Self-signed certificates can be used on an intranet. When clients only have to go through a local intranet to get to the server, there is virtually no chance of a man-in-the-middle attack.
  • Self-signed certificates can be used on personal sites with few visitors. If you have a small personal site that transfers non-critical information, there is very little incentive for someone to attack the connection.

In other words, when deploying your SoftNAS server into an enterprise use case, it may be required (or at least strongly recommended) that you switch the default self-signed certifications for your own enterprise certifications.

Purpose

This article provides the steps required to provide your own certifications to your SoftNAS instance.

Resolution

If you want to send or receive messages signed by root authorities and these authorities are not installed on the server, you must add a trusted root certificate manually.

Use the following steps to add or remove trusted root certificates to/from a server:

First, take a backup of the existing certificate and key files.

# mv /etc/pki/tls/certs/ca.crt /etc/pki/tls/certs/ca.crt-old

# mv /etc/pki/tls/private/ca.key /etc/pki/tls/private/ca.key-old


Next, upload the SSL certificate and key file using any preferred SSH client to the Softnas node and copy the newly uploaded certificates and keys files to the right path.

# cp new.crt /etc/pki/tls/certs/ca.crt

# cp new.key /etc/pki/tls/private/ca.key

After that make sure "ca.crt" file has the 644 file permission and "ca.key" has the 600 file permission with root user ownership. Otherwise, fix using the below commands.

# chown root:root /etc/pki/tls/certs/ca.crt

# chown root:root /etc/pki/tls/private/ca.key

# chmod 644 /etc/pki/tls/certs/ca.crt

# chmo 600 /etc/pki/tls/private/ca.key

Once the new certificates and keys are in right place, check the Nginx config file and restart the service.

# nginx -t

# systemctl restart nginx

Notes/Additional Info:

  • It is HIGHLY recommended to add the certificates before configuring replication to avoid any SnapReplicate™ interruption, as changing the keys will deactivate replication.
  • In case there is a need to change the keys after configuring SnapReplicate™:

Execute the following command on both the target and source node and erase the ssh fingerprints:

# sed -i '/OTHER-NODE-IP-ADDRESS/d' .ssh/known_hosts

Next, to add a new set of fingerprints, type the following command:

# ssh-keyscan   OTHER-NODE-IP-ADDRESS   >> .ssh/known_hosts


Log into the Web UI (StorageCenter) on both instances and try to activate HA again. The problem should be resolved. Contact support if you have further issues.



  • No labels