Renewing ganeti certificates of old cluster

[John N.]

Hi,

I still have a Debian 7 with ganeti 2.9.6 cluster which is hopefully meant to be taken out of prod soon but in the mean time I have noticed that the ganeti certificates are expiring:

Sat Jul  7 10:54:02 2018   - WARNING: cluster: While verifying /var/lib/ganeti/rapi.pem: Certificate expires in about 8 days
Sat Jul  7 10:54:02 2018   - WARNING: cluster: While verifying /var/lib/ganeti/server.pem: Certificate expires in about 8 days
Sat Jul  7 10:54:02 2018   - WARNING: cluster: While verifying /var/lib/ganeti/spice.pem: Certificate expires in about 8 days
Sat Jul  7 10:54:02 2018   - WARNING: cluster: While verifying /var/lib/ganeti/spice-ca.pem: Certificate expires in about 8 days

I would now like to renew all of them and based on the documentation (http://docs.ganeti.org/ganeti/2.12/html/cluster-keys-replacement.html) I listed below the commands I will need to apply on the master node in order to renew these certs:

openssl req -new -newkey rsa:1024 -days 1825 -nodes -x509 -keyout /var/lib/ganeti/rapi.pem -out /var/lib/ganeti/rapi.pem -batch
openssl req -new -newkey rsa:1024 -days 1825 -nodes -x509 -keyout /var/lib/ganeti/server.pem -out /var/lib/ganeti/server.pem -batch
openssl req -new -newkey rsa:1024 -days 1825 -nodes -x509 -keyout /var/lib/ganeti/spice.pem -out /var/lib/ganeti/spice.pem -batch
openssl req -new -newkey rsa:1024 -days 1825 -nodes -x509 -keyout /var/lib/ganeti/spice-ca.pem -out /var/lib/ganeti/spice-ca.pem -batch
chmod 0400 /var/lib/ganeti/*.pem
/etc/init.d/ganeti restart
gnt-cluster copyfile /var/lib/ganeti/server.pem
gnt-cluster command /etc/init.d/ganeti restart

Could someone confirm that this is correct? Also if this goes wrong, nothing should happen to the ganeti instances, right?

Cheers,
John

[Sascha Lucas]

Hi John,

> I still have a Debian 7 with ganeti 2.9.6 cluster

I've also some 2.9 clusters.

> (http://docs.ganeti.org/ganeti/2.12/html/cluster-keys-replacement.html)

...

> Could someone confirm that this is correct? Also if this goes wrong, nothing
> should happen to the ganeti instances, right?

I confirm that the doc-link above, paragraph "On older versions, which don’t
have this command" worked for me with ganeti-2.9 last year.

And yes, your instances keep running/unaffected.

Thanks, Sascha.

[John N.]

Thank you Sascha for confirming. I just renewed all the 4 certs now and it worked smoothly...

Cheers,
J.