Prerequisites

1. DPOD installed in version 1.0.14.0 or above.

2. Certificate and Key files provided in “.pem“ format.

Update Certificate

1. Cell Environment users should follow all the steps on the cell manager and all the cell members.

2. Set the config path prefix parameter:

   STORE_CONFIG_PREFIX="/app/opensearch_nodes/config/MonTier-es-raw-trans-"

   1. For 1.0.14.0 use:

      STORE_CONFIG_PREFIX="/app/elasticsearch_nodes/config/MonTier-es-raw-trans-"

3. Create new custom keys directory

   mkdir -p /app/keys/store/custom

4. Copy the key and certificate pem files to this directory. i.e.:

   ls /app/keys/store/custom
   my-cert.pem  my-key.pem

5. Deploy key and certificate pem files to all Store nodes:

   ls -d1 ${STORE_CONFIG_PREFIX}*/certs | xargs -I ff cp -f /app/keys/store/custom/<certificate file name> ff
   ls -d1 ${STORE_CONFIG_PREFIX}*/certs | xargs -I ff cp -f /app/keys/store/custom/<key file name> ff

6. Update file names in Store nodes configuration files.

   ls -1 ${STORE_CONFIG_PREFIX}*/opensearch.yml | xargs -I ff sed -i "s|plugins.security.ssl.http.pemcert_filepath.*|plugins.security.ssl.http.pemcert_filepath: certs/<certificate file name>|" ff
   ls -1 ${STORE_CONFIG_PREFIX}*/opensearch.yml | xargs -I ff sed -i "s|plugins.security.ssl.http.pemkey_filepath.*|plugins.security.ssl.http.pemkey_filepath: certs/<key file name>|" ff

   1. For 1.0.14.0 use:

      ls -1 ${STORE_CONFIG_PREFIX}*/elasticsearch.yml | xargs -I ff sed -i "s|opendistro_security.ssl.http.pemcert_filepath.*|opendistro_security.ssl.http.pemcert_filepath: certs/<certificate file name>|" ff
      ls -1 ${STORE_CONFIG_PREFIX}*/elasticsearch.yml | xargs -I ff sed -i "s|opendistro_security.ssl.http.pemkey_filepath.*|opendistro_security.ssl.http.pemkey_filepath: certs/<key file name>|" ff

7. Stop and start all the application services using app-util.sh

8. Cell Environment users should stop and start Syslog and WS-M agents in all cell members from app-util.sh:

   1. app-utils.sh → Stop Service → syslog → stop only this service

   2. app-utils.sh → Stop Service → wsm → stop only this service

   3. app-utils.sh → Start Service → syslog → start only this service

   4. app-utils.sh → Start Service → wsm → start only this service