Renew or replace the RabbitMQ certificates managed by salt-minion¶

This section describes how to renew or replace the RabbitMQ certificates managed by salt-minion.

To renew or replace the RabbitMQ certificates managed by salt-minion:

1. Log in to the Salt Master node.

2. Verify the certificates validity dates:

   salt -C 'I@rabbitmq:server' cmd.run 'openssl x509 \
   -in /etc/rabbitmq/ssl/cert.pem -text -noout' | grep -Ei 'after|before'
   

   Example of system response:

   Not Before: Apr 27 12:37:14 2018 GMT
   Not After : Apr 27 12:37:14 2019 GMT
   Not Before: Apr 27 12:37:08 2018 GMT
   Not After : Apr 27 12:37:08 2019 GMT
   Not Before: Apr 27 12:37:13 2018 GMT
   Not After : Apr 27 12:37:13 2019 GMT
   

3. Remove the certificates from the RabbitMQ nodes:

   salt -C 'I@rabbitmq:server' cmd.run 'rm -f /etc/rabbitmq/ssl/cert.pem'
   

4. If you replace the certificates, remove the private key:

   salt -C 'I@rabbitmq:server' cmd.run 'rm -f /etc/rabbitmq/ssl/key.pem'
   

5. Regenerate the certificates on the RabbitMQ nodes:

   salt -C 'I@rabbitmq:server' state.sls salt.minion.cert
   

6. Verify that the certificates validity dates have changed:

   salt -C 'I@rabbitmq:server' cmd.run 'openssl x509 \
   -in /etc/rabbitmq/ssl/cert.pem -text -noout' | grep -Ei 'after|before'
   

   Example of system response:

   Not Before: Jun  4 23:52:40 2018 GMT
   Not After : Jun  4 23:52:40 2019 GMT
   Not Before: Jun  4 23:52:41 2018 GMT
   Not After : Jun  4 23:52:41 2019 GMT
   Not Before: Jun  4 23:52:41 2018 GMT
   Not After : Jun  4 23:52:41 2019 GMT
   

7. Restart the RabbitMQ services one by one:

   salt -C 'I@rabbitmq:server' cmd.run 'service rabbitmq-server stop; \
   service rabbitmq-server start' -b1
   

8. Verify the RabbitMQ cluster status:

   salt -C 'I@rabbitmq:server' cmd.run 'rabbitmqctl cluster_status'
   

   Example of system response:

   msg03.multinode-ha.int:
       Cluster status of node rabbit@msg03
       [{nodes,[{disc,[rabbit@msg01,rabbit@msg02,rabbit@msg03]}]},
        {running_nodes,[rabbit@msg01,rabbit@msg02,rabbit@msg03]},
        {cluster_name,<<"openstack">>},
        {partitions,[]},
        {alarms,[{rabbit@msg01,[]},{rabbit@msg02,[]},{rabbit@msg03,[]}]}]
   msg01.multinode-ha.int:
       Cluster status of node rabbit@msg01
       [{nodes,[{disc,[rabbit@msg01,rabbit@msg02,rabbit@msg03]}]},
        {running_nodes,[rabbit@msg03,rabbit@msg02,rabbit@msg01]},
        {cluster_name,<<"openstack">>},
        {partitions,[]},
        {alarms,[{rabbit@msg03,[]},{rabbit@msg02,[]},{rabbit@msg01,[]}]}]
   msg02.multinode-ha.int:
       Cluster status of node rabbit@msg02
       [{nodes,[{disc,[rabbit@msg01,rabbit@msg02,rabbit@msg03]}]},
        {running_nodes,[rabbit@msg03,rabbit@msg01,rabbit@msg02]},
        {cluster_name,<<"openstack">>},
        {partitions,[]},
        {alarms,[{rabbit@msg03,[]},{rabbit@msg01,[]},{rabbit@msg02,[]}]}]