Replacing the Server Certificate

Updated on 2025-02-06 GMT+08:00

View PDF

For security purposes, you may want to use a Secure Socket Layer (SSL) certificate issued by a third-party certification authority. The Agent allows you to replace authentication certificates and private key files as long as you provide the authentication certificates and private-public key pairs. The update to the certificate can take effect only after the Agent is restarted, hence you are advised to update the certificate during off-peak hours.

Prerequisites

The username and password for logging in to the console have been obtained.
The username and password for logging in to a server have been obtained.
New certificates in the X.509v3 format have been obtained.

Context

The Agent is pre-deployed with the Agent CA certificate bcmagentca, private key file of the CA certificate server.key (), and authentication certificate server.crt. All these files are saved in /home/rdadmin/Agent/bin/nginx/conf (if you use Linux) or \bin\nginx\conf (if you use Windows).
You need to restart the Agent after replacing a certificate to make the certificate effective.

Replacing the Server Certificate in Linux

Log in the Linux server with the Agent installed.
Run the TMOUT=0 command to prevent PuTTY from exiting due to session timeout.

NOTE:

After you run the preceding command, the system continues to run even when no operation is performed, which brings security risks. To ensure system security, run the exit command to exit the system after you finish the operations.
Run the su - rdadmin command to switch to user rdadmin.
Run the cd /home/rdadmin/Agent/bin command to go to the script path.

NOTE:

The installation path of the Agent is /home/rdadmin/Agent.
Run the sh agent_stop.sh command to stop the Agent running.
Place the new certificates and private key files in the specified directory.

NOTE:

Place new certificates in the /home/rdadmin/Agent/bin/nginx/conf directory.
Run the /home/rdadmin/Agent/bin/agentcli chgkey command.
The following information is displayed:
```
Enter password of admin:
```
NOTE:

admin is the username configured during the Agent installation.
Type the login password of the Agent and press Enter.

The following information is displayed:
```
Change certificate file name:
```
Enter a name for the new certificate and press Enter.

NOTE:

If the private key and the certificate are the same file, names of the private key and the certificate are identical.

The following information is displayed:
```
Change certificate key file name: 
```
Enter a name for the new private key file and press Enter.

The following information is displayed:
```
Enter new password: 
Enter the new password again:
```
Enter the protection password of the private key file twice. The certificate is then successfully replaced.
Run the sh agent_start.sh command to start the Agent.

Replacing the Server Certificate in Windows

Log in to the Windows server with the Agent installed.
Open the CLI and go to the Installation path\bin directory.
Run the agent_stop.bat command to stop the Agent running.
Place the new certificates and private key files in the specified directory.

NOTE:

Place new certificates in the installation path\bin\nginx\conf directory.
Run the agentcli.exe chgkey command.

The following information is displayed:
```
Enter password of admin: 
```
NOTE:

admin is the username configured during the Agent installation.
Enter a name for the new certificate and press Enter.

NOTE:

If the private key and the certificate are the same file, names of the private key and the certificate are identical.
The following information is displayed:
```
Change certificate key file name: 
```
Enter a name for the new private key file and press Enter.

The following information is displayed:
```
Enter new password: 
Enter the new password again: 
```
Enter the protection password of the private key file twice. The certificate is then successfully replaced.
Run the agent_start.bat command to start the Agent.