How do I configure an NFM-P auxiliary server to request the NSP TLS certificate?

Purpose
CAUTION 

CAUTION

Service Disruption

Performing the procedure requires that you shut down the auxiliary server, which may be service-affecting.

If the auxiliary server is in service, ensure that you perform the procedure only during a scheduled maintenance period.

The following steps describe how to configure an NFM-P auxiliary server to request a TLS certificate from the NSP cluster, as is required when a new or updated certificate is available.

Steps
 
1 

Log in to the auxiliary server station as the nsp user.

2 

Open a console window.

3 

Stop the auxiliary server.

  1. Enter the following:

    bash$ cd /opt/nsp/nfmp/auxserver/nms/bin ↵

  2. Enter the following:

    bash$ ./auxnmsserver.bash auxstop ↵

  3. Enter the following:

    bash$ ./auxnmsserver.bash auxappserver_status ↵

    The auxiliary server is stopped when the following message is displayed:

    Auxiliary Server is stopped 

    If the command output indicates that the server is not completely stopped, wait five minutes and then re-enter the command in this step to check the server status.

    Do not proceed to the next step until the server is completely stopped.

4 

Enter the following to switch to the root user:

bash$ su - ↵

5 

Enter the following:

# samconfig -m aux ↵

The following is displayed:

Start processing command line inputs...

<aux> 

6 

Enter the following:

<aux> configure tls ↵

The prompt changes to <aux configure tls>.

7 

Enter the following:

<aux configure tls> no keystore-file ↵

8 

Perform one of the following:

  1. Enter the following to use the default keystore password, which is available from technical support:

    <aux configure tls> no keystore-pass ↵

  2. Enter the following to assign a keystore password:

    <aux configure tls> keystore-pass password ↵

    where password is the password to assign

9 

Enter the following:

<main configure tls> pki-server address ↵

where address is one of the following values in the platform—ingressApplications—ingressController section of the config.yml file on the local NSP deployer host:

In the internalAddresses subsection, if configured, otherwise, in the clientAddresses subsection:

  • if configured, the advertised value

  • otherwise, the virtualIp value

10 

Enter the following:

<main configure tls> pki-server-port 80 ↵

11 

Enter the following:

<aux configure tls> exit ↵

The prompt changes to <aux>.

12 

Enter the following:

<aux> apply ↵

The configuration is applied.

The auxiliary server:

  • generates a TLS certificate

  • sends a CSR to the PKI server

  • receives from the PKI server the signed TLS certificate

13 

Enter the following:

<aux> exit ↵

The samconfig utility closes.

14 

Enter the following to return to the nsp user:

# exit ↵

15 

Start the auxiliary server.

  1. Enter the following:

    bash$ ./auxnmsserver.bash auxstart ↵

  2. Enter the following:

    bash$ ./auxnmsserver.bash auxappserver_status ↵

    The server status is displayed; the server is fully initialized if the status is the following:

    Auxiliary Server process is running.  See auxnms_status for more detail.

    If the server is not fully initialized, wait five minutes and then repeat this step. Do not perform the next step until the server is fully initialized.

16 

Close the console window.

End of steps