6.3 HTTPS TLS Certificate Change Procedure

OCLM HTTPS serving files are:

/opt/oclm-service/bin/server.crt.pem

/opt/oclm-service/bin/server.key.pem

server.crt.pem is the HTTPS certificate for the OCLM REST endpoint. server.key.pem is the matching HTTPS private key. The HTTPS private key should be provided in a service-startup compatible PEM format. Protect server.key.pem with 0600 permissions and admusr:admusr ownership.

Restart OCLM after replacing the HTTPS serving files.

Run the following command to create the staging directory:

STAGE_DIR=/home/admusr/oclm-staging/https-tls
mkdir -p "$STAGE_DIR"
chmod 700 "$STAGE_DIR"

Copy the new server.crt.pem and server.key.pem into $STAGE_DIR using the customer-approved secure transfer method.

Validate the staged files:

openssl x509 -in "$STAGE_DIR/server.crt.pem" -noout -subject -issuer -dates
openssl pkey -in "$STAGE_DIR/server.key.pem" -noout -check

Stop OCLM and back up the existing HTTPS files by renaming them:

sudo systemctl stop oclm-service
sudo systemctl status --no-pager oclm-service
sudo mv /opt/oclm-service/bin/server.crt.pem /opt/oclm-service/bin/server.crtbk.pem
sudo mv /opt/oclm-service/bin/server.key.pem /opt/oclm-service/bin/server.keybk.pem

Install the new HTTPS TLS files:

sudo install -m 0640 "$STAGE_DIR/server.crt.pem" /opt/oclm-service/bin/server.crt.pem
sudo install -m 0600 "$STAGE_DIR/server.key.pem" /opt/oclm-service/bin/server.key.pem
sudo chown admusr:admusr /opt/oclm-service/bin/server.crt.pem /opt/oclm-service/bin/server.key.pem

Remove the staged copies:

rm -f "$STAGE_DIR/server.crt.pem" "$STAGE_DIR/server.key.pem"
rmdir "$STAGE_DIR" 2>/dev/null || true

Start and validate OCLM:

sudo systemctl start oclm-service
sudo systemctl status --no-pager oclm-service
sudo ss -ltnp | grep ':8989'
sudo tail -n 200 /var/log/oclm.log

Restore the previous self-signed HTTPS files if required:

sudo systemctl stop oclm-service
sudo mv /opt/oclm-service/bin/server.crtbk.pem /opt/oclm-service/bin/server.crt.pem
sudo mv /opt/oclm-service/bin/server.keybk.pem /opt/oclm-service/bin/server.key.pem
sudo chown admusr:admusr /opt/oclm-service/bin/server.crt.pem /opt/oclm-service/bin/server.key.pem
sudo chmod 0640 /opt/oclm-service/bin/server.crt.pem
sudo chmod 0600 /opt/oclm-service/bin/server.key.pem
sudo systemctl start oclm-service
sudo systemctl status --no-pager oclm-service