How do I configure an NFM-P main server to request the NSP TLS certificate?

Purpose
CAUTION 

CAUTION

Service Disruption

Performing the procedure requires that you shut down the main server, which may be service-affecting.

If the main server is in service, ensure that you perform the procedure only during a scheduled maintenance period.

The following steps describe how to configure an NFM-P main server to request a TLS certificate from the NSP cluster, as required when a new or updated certificate is available.

Steps
 
1 

Log in to the main server station as the nsp user.

2 

Open a console window.

3 

Stop the main server.

  1. Enter the following:

    bash$ cd /opt/nsp/nfmp/server/nms/bin ↵

  2. Enter the following:

    bash$ ./nmsserver.bash stop ↵

  3. Enter the following:

    bash$ ./nmsserver.bash appserver_status ↵

    The main server is stopped when the following message is displayed:

    Main Server is stopped 

    If the command output indicates that the server is not completely stopped, wait five minutes and then re-enter the command in this step to check the server status.

    Do not proceed to the next step until the server is completely stopped.

  4. Enter the following to switch to the root user:

    bash$ su ↵

4 

Enter the following:

# samconfig -m main ↵

The following is displayed:

Start processing command line inputs...

<main> 

5 

Enter the following:

<main> configure tls ↵

The prompt changes to <main configure tls>.

6 

Enter the following:

<main configure tls> no keystore-file ↵

7 

Enter the following:

<main configure tls> no truststore-file ↵

8 

Perform one of the following:

  1. Enter the following to use the default keystore password, which is available from technical support:

    <main configure tls> no keystore-pass ↵

  2. Enter the following to assign a keystore password:

    <main configure tls> keystore-pass password ↵

    where password is the password to assign

9 

Perform one of the following:

  1. Enter the following to use the default truststore password, which is available from technical support:

    <main configure tls> no truststore-pass ↵

  2. Enter the following to assign a truststore password:

    <main configure tls> truststore-pass password ↵

    where password is the password to assign

10 

Enter the following:

<main configure tls> alias alias ↵

where alias is the keystore alias to assign

11 

Enter the following:

<main configure tls> pki-server address ↵

where address is one of the following values in the platform—ingressApplications—ingressController section of the config.yml file on the local NSP deployer host:

In the internalAddresses subsection, if configured, otherwise, in the clientAddresses subsection:

  • if configured, the advertised value

  • otherwise, the virtualIp value

12 

Enter the following:

<main configure tls> pki-server-port 80 ↵

13 

Enter the following:

<main configure tls> exit ↵

The prompt changes to <main>.

14 

Enter the following:

<main> apply ↵

The configuration is applied.

The main server:

  • generates a TLS certificate

  • sends a CSR to the PKI server

  • receives from the PKI server the signed TLS certificate

15 

Enter the following:

<main> exit ↵

The samconfig utility closes.

16 

Enter the following to return to the nsp user:

# exit ↵

17 

Start the main server.

  1. Enter the following:

    bash$ ./nmsserver.bash start ↵

  2. Enter the following:

    bash$ ./nmsserver.bash appserver_status ↵

    The server status is displayed; the server is fully initialized if the status is the following:

    Application Server process is running.  See nms_status for more detail.

    If the server is not fully initialized, wait five minutes and then repeat this step. Do not perform the next step until the server is fully initialized.

18 

Close the console window.

End of steps