Importing a Certificate

Scenarios

CA certificates are used to encrypt data during communication for FusionInsight Manager modules, component clients of the cluster, and component servers of the cluster to implement secure communication. CA certificates can be quickly imported to FusionInsight Manager for product security. Import CA certificates in following scenarios:

• When the cluster is installed for the first time, you need to replace the enterprise certificate.
• If the enterprise certificate has expired or security hardening is required, you need to replace it with a new certificate.

Impact on the System

• During certificate replacement, the cluster needs to be restarted. In this case, the system cannot be accessed and cannot provide services.
• After the certificate is replaced, the certificates used by all components and FusionInsight Manager modules are automatically updated.
• After the certificate is replaced, you need to reinstall the certificate in the local environment where the certificate is not trusted.

Prerequisites

• The certificate file and key file can be applied for from the enterprise certificate administrator or generated by the MRS cluster administrator.
• Obtain the files to be imported to the MRS cluster, including the CA certificate file (such as *.crt), key file (*.key), and file (password.property) that saves the key file password. The certificate name and key name can contain uppercase letters, lowercase letters, and digits. After the preceding files are generated, they need to be compressed into a package in TAR format.
• Prepare a password for accessing the key file. For example, Userpwd@123.

  The password complexity requirements are as follows. If the password complexity does not meet the following requirements, security risks may exist:

  • It must contain at least eight characters.
  • It must contain at least four of the following character types: uppercase letters, lowercase letters, digits, and special characters ~`!?,.;-_'(){}[]/<>@#$%^&*+|\=.
• When applying for a certificate from the certificate administrator, provide the password for accessing the key file and apply for the certificate files in CRT, CER, CERT, and PEM formats and the key files in KEY and PEM formats. The applied certificates must have the issuing function.

Procedure

1. Log in to FusionInsight Manager and choose System > Certificate.
2. Click on the right of Upload Certificate. In the File selection dialog box, view the obtained TAR package of the certificate file and select the file.
3. Click Upload.

   The system uploads the compressed package and automatically imports the package.

4. After the package is imported, the system prompts you to synchronize the configuration and restart the web service for the new certificate to take effect. Click OK.
5. In the displayed dialog box, enter the password of the current login user and click OK. The cluster configuration is automatically synchronized and the web service is restarted.
6. After the cluster is restarted, enter the URL for accessing FusionInsight Manager in the address box of the browser and check whether the FusionInsight Manager WebUI can be successfully displayed.
7. Log in to FusionInsight Manager.
8. Choose Cluster > Name of the desired cluster > Dashboard > More > Restart.
9. In the displayed dialog box, enter the password of the current login user and click OK.