Replacing the CA Certificate

Scenarios

The MRS CA certificate is used for data encryption during the communication between the client and the server of a component to ensure communication security. You can replace the CA certificate on FusionInsight Manager to ensure product security. This operation is applicable to the following scenarios:

• After a cluster is installed for the first time, import an enterprise certificate.
• If an enterprise certificate has expired or requires security hardening, replace it with a new one.

After the CA certificate is replaced, the certificates that are used by HDFS, YARN, MapReduce, HBase, Loader, Hue, Flink (MRS 3.2.0 or later)Oozie, Hive, Tomcat, CAS, HTTPD, and LDAP in MRS will be automatically updated.

You can either apply for the certificate and key files from your enterprise certificate center or generate them yourself as a cluster user.

Notes and Constraints

• Only CA certificates with issuing capabilities and in X.509 format can be imported into FusionInsight.
• FusionInsight requires that the OS encoding format be en_US.UTF-8 or POSIX. Otherwise, the certificate function will be abnormal.
• If an isolated faulty node exists in the current cluster, the CA certificate of the node will not be replaced. After a node is de-isolated, you must reinstall the services running on that node to ensure that both the node and the cluster use the same CA certificate.
• This section applies only to MRS 3.x or later.

Impact on the System

• The MRS system must be restarted during the replacement and cannot be accessed or provide services.
• After the certificate is replaced, the certificates used by all components and FusionInsight Manager modules are automatically updated.
• After the certificate is replaced, you need to reinstall the certificate in the local environment where the certificate is not trusted.

Prerequisites

• You have obtained the files to be imported to the MRS cluster, including the CA certificate file (*.crt), key file (*.key), and file that saves the key file password (password.property). The certificate name and key name support letters and digits.
• You have prepared a password for accessing the key file, for example, Userpwd@123.

  To avoid potential security risks, the password must meet the following complexity requirements:

  • The password contains at least 8 characters.
  • The password contains at least four types of the following: uppercase letters, lowercase letters, numbers, and special characters ~`!?,.;-_'(){}[]/<>@#$%^&*+|\=
• When applying for a certificate from the certificate center, provide the password for accessing the key file and apply for the certificate files in CRT, CER, CERT, and PEM formats and the key files in KEY and PEM formats. The applied certificate must have the issuing function.

Replacing the CA Certificate

1. Log in to any management node in the cluster as user omm.
2. Select a method for generating the certificate and key files.
   • If the certificate is generated by the certificate center, save the certificate file and key file to the omm user directory on the management node.

     If the obtained certificate file is not in the .crt format and the key file is not in the .key format, run the following commands to change the file formats:

     mv Certificate name.Certificate format Certificate name.crt

     mv Key name.Key format Key name.key

     For example, run the following commands to name the certificate file ca.crt and the key file ca.key:

     mv server.cer ca.crt

     mv server_key.pem ca.key

   • If the certificate is generated by the cluster user, run the following commands to generate the certificate file and key file in the omm user directory on the management node:
     1. Generate the key file.

        Run the following command to check whether the OpenSSL version is 1.1.1 or later:

        /usr/bin/openssl version

        • If yes, run the following command:

          openssl genrsa -out Key name.key -aes256 3072

        • If no, run the following command:

          openssl genrsa -out Key name.key -aes256 3072 -sha256

        For example, to generate the key file ca.key, run the following command:

        openssl genrsa -out ca.key -aes256 3072 -sha256

        Enter the password twice as prompted, and press Enter.

        Enter pass phrase for ca.key:
        Verifying - Enter pass phrase for ca.key:

     2. Generate the certificate file.

        openssl req -new -x509 -days 36500 -key Key name.key -out Certificate name.crt -subj "/C=cn/ST=guangdong/L=shenzhen/O=huawei/OU=huawei/CN=huawei" -sha256

        For example, to generate the certificate file ca.crt, run the following command:

        openssl req -new -x509 -days 36500 -key ca.key -out ca.crt -subj "/C=cn/ST=guangdong/L=shenzhen/O=huawei/OU=huawei/CN=huawei" -sha256

        Enter the password for the key file as prompted, and press Enter.

        Enter pass phrase for ca.key:

3. Run the following command in the omm user directory on the management node to save the password for accessing the key file.

   sh ${BIGDATA_HOME}/om-server/om/sbin/genPwFile.sh

   Enter the password twice as prompted, and press Enter. After being encrypted, the password is saved in password.property.

   Please input key password: 
   Please Confirm password:

   • The password.property file generated on the node you have logged is available only for the current cluster and cannot be used for other clusters. The file contains security information. Keep it secure and control the access permission.
   • In active/standby DR scenarios, the genPwFile.sh script must be executed on both the active and DR cluster nodes, and the same password must be entered for the two clusters.

4. Compress the three files in the .tar format and save them to the local computer.

   tar -cvf Package name Certificate name .crt Key name .key password.property

   For example, tar -cvf test.tar ca.crt ca.key password.property

5. Log in to MRS Manager of the cluster and choose System > Certificate.

   For details about how to log in to MRS Manager, see Accessing MRS Manager.

6. Confirm the MRS cluster version and perform the operations accordingly.
   • For clusters earlier than MRS 3.6.0, perform Step 7 to Step 12.
   • For MRS 3.6.0 or later clusters, perform Step 13 to Step 19.

7. In the Upload Certificate area, click the file selection button. In the window for selecting files, select the obtained .tar certificate file packages and open them and click Upload. The system automatically imports the certificate.
8. After the certificate is imported, the system prompts you to synchronize the cluster configuration and restart the web service for the new certificate to take effect. After you complete these operations, click OK.
9. In the dialog box that is displayed, enter the password and click OK to automatically synchronize the cluster configuration and restart the web service.

   If the page is refreshed or the browser is closed during cluster configuration synchronization, perform the following operations to restart the web service:

   1. Log in to the active OMS node as user omm.
   2. Run the following command to restart HTTPD. xxx indicates the HTTPD version number. Replace it with the actual version number.

      sh ${BIGDATA_HOME}/om-server/Apache-httpd-xxx/setup/restarthttpd.sh

   3. Run the following command to restart Tomcat:

      sh ${BIGDATA_HOME}/om-server/tomcat/bin/shutdown.sh;sh ${BIGDATA_HOME}/om-server/tomcat/bin/startup.sh

   4. Run the following command to restart Knox:

      sh /opt/knox/bin/restart-knox.sh

10. Enter the URL for accessing FusionInsight Manager in the address box of the browser and check whether the FusionInsight Manager web page can be successfully displayed.

    The enterprise certificate has expired or security is hardened. After replacing the MRS certificate, replace the local certificate as well.

11. Log in to FusionInsight Manager and choose Cluster > Overview > More > Restart (for MRS 3.3.0 or later, choose More > Restart in the upper right corner on the Homepage). In the displayed dialog box, enter the password of the current login user and click OK.

    After replacing the CA certificate, you must restart the cluster offline for the certificate to take effect. Rolling restart is not supported.

12. In the displayed restart confirmation dialog box, click OK.
13. If the current cluster is MRS 3.6.0 or later, click Add on the Certificate page of MRS Manager. In the file window, browse to the obtained certificate file TAR package, open the package, and click Upload. The system automatically imports the certificate.

    If the status of a certificate changes to Changing after import, the certificate has been imported but not yet issued.

14. After the certificate is imported, click Issue Certificate.
15. In the displayed dialog box, enter the password and click OK. Confirm the operation impact and click OK.
16. After the certificate is issued, enter the URL for accessing MRS Manager in the address box of the browser and check whether the MRS Manager web page can be successfully displayed.
    • If the enterprise certificate has expired or its security is enhanced, replace the local certificate after replacing the MRS certificate.
    • Issuing a new certificate will restart the web service. You need to log in to the system again.
    • If a new certificate is issued, the certificate status changes to Issued, and the certificate takes effect after the components are restarted. The status of the previously issued certificate changes to Invalid, indicating that the certificate is no longer used by the cluster and components.

17. In the upper right corner of Homepage, click More and select Restart or Rolling-restart Service. In the displayed dialog box, enter the password of the current login user and click OK.

    After replacing the CA certificate, restart the cluster for the certificate to take effect.

18. In the displayed restart confirmation dialog box, click OK.
19. Choose Cluster > Client Management and check whether any clients are already installed in the cluster.
    • If yes, update the existing clients.
    • If no, no further action is required.