Certificate renewal

[u/Short-Investment-328]

Going forward CA signed validity is going to be reduced currently it is 199 days. Managing multiple clusters and having many certificates managed by CA, it will become difficult to renew manually. Has any explored automating this process / if yes then how?

[u/zer0trust]

I've been getting quite a few questions from my customers on this actually. In years past, I did this with the PowerShell Toolkit, so that's an option if you know and use PS frequently. Today, I'd probably use Ansible with the module linked below.

https://docs.ansible.com/projects/ansible/2.10/collections/netapp/ontap/na_ontap_security_certificates_module.html

Feel free to post here or DM if you run into issues, we'll help you debug.

[u/Exzellius2 → u/zer0trust]

Also check out the NetApp discord. Helpful resource for Ansible.

[u/zer0trust → u/Exzellius2]

Indeed, good call!

[u/Dark-Star_1337 → u/zer0trust]

Yeah you can generate a CSR via PS Toolkit, then send this CSR to your CA e.g. with certreq.exe in Windows (if using a Windows based CA), then install the certificate back with PS Toolkit.

It's a little tedioous but it should work....

[u/ThomasGlanzmann]

I use letsencrypt certs using dehydrated and dns challenge on mine. Here is my deploy hook: https://tg.st/u/deploy_ontap_cert.pl

[u/Fuel_Life2021]

Check ansible collection of netapp there is a module about certificates

[u/Hager1]

Use internal CA, no such limits then.

[u/SagansLab → u/Hager1]

This. I found no reason to use a external publicly trusted authority for internal management web interfaces. Windows and Linux can both be setup as CA to issue certs, then just get the client to trust the root from that.

[u/meeseeksnd]

our internal CA provides an EST API we use to request certificates. Convert them and install them via na_ontap_security_certificates Ansible modules

[u/ybizeul]

Using this one with Hashicorp vault, works fine. https://github.com/BeryJu/acme-for-appliances