CreateSSLCertificate

The Oracle Communications Unified Assurance SSL Certificate and Key Creation application runs OpenSSL commands to create keys and certificates. The generated files are located in the $A1BASEDIR/etc/ssl directory.

You run this application from the command line.

The tree of trust for Unified Assurance generated certificates is:

Note:

In upgraded systems that have not yet rotated certificates, the legacy Unified Assurance Global CA certificate is named Assure1CA.crt. New installations and rotated systems use UnifiedAssuranceCA.crt.

If you provide the --Type option and specify UnifiedAssuranceCA, the application creates a new Unified Assurance Global CA certificate and key, then creates the Site CA and dependent Unified Assurance generated certificates.

If you provide the --Type option and specify SiteCA, the application creates a new certificate authority that is specific to the site and automatically creates the Host, Vision, and User-* certificates. It also creates BundleCA.crt, BundleCA.p12, and BundleCA.jks files that contain the Unified Assurance certificate chain. These bundle files are used in application configurations.

Use --RotateCertificates to rotate Unified Assurance generated certificates. Certificate rotation creates a new Unified Assurance Global CA, creates cross-signed Global CA and Site CA certificates for the transition, creates a new Site CA, regenerates dependent Unified Assurance certificates, updates trust stores and certificate bundle files, and broadcasts an update request to other Unified Assurance servers. If you included custom external intermediate certificates in your previous BundleCA.crt, certificate rotation preserves those external certificates in the new BundleCA.crt file. Run certificate rotation on the primary presentation server as the root user or with sudo privileges. For more information, see Rotating Unified Assurance Generated Certificates in Unified Assurance Security Guide.

After rotating certificates, CreateSSLCertificate shows a list of any servers that were unresponsive and did not receive the certificate update broadcast. On each of these servers, you can run CreateSSLCertificate --UpdateLocalCerts to apply the rotation. This command reads shared certificate files from the primary presentation server, updates the local certificate files, regenerates the local Host certificate, and updates OpenSearch and Podman certificate locations when those directories exist.

CreateSSLCertificate Usage Examples

To create a SiteCA certificate and dependencies:

./CreateSSLCertificate --Type SiteCA

To create a Unified Assurance Global CA certificate:

./CreateSSLCertificate --Type UnifiedAssuranceCA

To create a Web certificate, with separate host FQDNs:

./CreateSSLCertificate --Type Web --CN host1.example.com --AltCN host1-pres1.example.com --AltCN host1-pres2.example.com

Note:

When creating web certificates in a redundant setup, you must specify --AltCN for the host FQDNs of both presentation servers. This allows both servers to share a single certificate and permits connections to individual servers for troubleshooting.

By default, CreateSSLCertificate will not run if the requested certificate already exists. Use the --Force option to override this behavior by revoking the old certificate and creating a new one with the same name.

To have a certificate signed by a third party CA, you can use the Web.csr for the certificate signing request.

To rotate Unified Assurance generated certificates:

./CreateSSLCertificate --RotateCertificates

To update local certificate files after a server misses the rotation broadcast:

./CreateSSLCertificate --UpdateLocalCerts

Administration Details

The following list shows the technical details you will need for advanced administration of the application: