renew custom ca too

Author: evgeni

guides/common/assembly_renewing-certificates.adoc

@@ -6,10 +6,10 @@ include::modules/proc_renewing-self-signed-certificates-on-server.adoc[leveloffs
 include::modules/proc_renewing-self-signed-ca-certificates.adoc[leveloffset=+1]
 endif::[]
 
-include::modules/proc_planning-for-self-signed-ca-certificate-renewal.adoc[leveloffset=+1]
-
 include::modules/proc_renewing-a-custom-ssl-certificate-on-server.adoc[leveloffset=+1]
 
+include::modules/proc_renewing-a-custom-server-ca-certificate.adoc[leveloffset=+1]
+
 ifndef::containerized[]
 include::modules/proc_renewing-a-custom-ssl-certificate-on-smart-proxy.adoc[leveloffset=+1]
 endif::[]

guides/common/modules/con_refreshing-the-self-signed-ca-certificate-on-hosts.adoc

@@ -7,7 +7,7 @@
 When you change the CA certificate on your {ProjectServer}, you must refresh the CA certificate on your hosts.
 
 Ensure that you use a temporary dual CA certificate file for uninterrupted operation.
-For more information, see {AdministeringDocURL}planning-for-self-signed-ca-certificate-renewal[Planning for self-signed CA certificate renewal] in _{AdministeringDocTitle}_.
+For more information, see {AdministeringDocURL}renewing-a-custom-server-ca-certificate[Renewing a custom server CA certificate] in _{AdministeringDocTitle}_.
 
 If you have already changed the CA certificate on {ProjectServer} without using the temporary dual CA certificate file, you must refresh the certificate on hosts manually because the scripted variant will not recognize {ProjectServer}.
 

guides/common/modules/proc_planning-for-self-signed-ca-certificate-renewal.adoc

@@ -0,0 +1,71 @@
+:_mod-docs-content-type: PROCEDURE
+
+[id="renewing-a-custom-server-ca-certificate"]
+= Renewing a custom server CA certificate
+
+[role="_abstract"]
+If you need to update the certification authority (CA) certificate that signed your {ProjectServer} and {SmartProxyServers} certificates, add the new CA certificate and use a temporary dual CA certificate file to retain the HTTPS connections to your {ProjectServer} during the renewal.
+
+.Procedure
+. Add the new SSL certificate to the CA certificate file on {ProjectServer} and keep the old SSL certificate.
++
+[options="nowrap", subs="+quotes,attributes"]
+----
+# cat _/root/{project-context}_cert/old_ca_cert_bundle.pem_ _/root/{project-context}_cert/new_ca_cert_bundle.pem_ > _/root/{project-context}_cert/ca_cert_bundle.pem_
+----
+. Renew the certificates on {ProjectServer}.
++
+[options="nowrap" subs="+quotes,attributes"]
+ifdef::containerized[]
+----
+# {foremanctl} deploy \
+--certificate-source custom_server \
+--certificate-server-certificate "_/root/{project-context}_cert/{project-context}_cert.pem_" \
+--certificate-server-key "_/root/{project-context}_cert/{project-context}_cert_key.pem_" \
+--certificate-server-ca-certificate "_/root/{project-context}_cert/ca_cert_bundle.pem_"
+----
+endif::[]
+ifndef::containerized[]
+----
+# {installer-scenario} \
+--certs-server-cert "/root/_{project-context}_cert/{project-context}_cert.pem_" \
+--certs-server-key "/root/_{project-context}_cert/{project-context}_cert_key.pem_" \
+--certs-server-ca-cert "/root/_{project-context}_cert/ca_cert_bundle.pem_" \
+--certs-update-server \
+--certs-update-server-ca
+----
+endif::[]
+. Renew the certificates on any {SmartProxyServers}.
+. Deploy the dual CA certificate on hosts.
+. Remove the old certificate from the CA certificates file on {ProjectServer}, so the CA certificate file contains only the new SSL certificate.
++
+[options="nowrap", subs="+quotes,attributes"]
+----
+# cat _/root/{project-context}_cert/new_ca_cert_bundle.pem_ > _/root/{project-context}_cert/ca_cert_bundle.pem_
+----
+. Renew the certificates on {ProjectServer} and any {SmartProxyServers}.
++
+[options="nowrap" subs="+quotes,attributes"]
+ifdef::containerized[]
+----
+# {foremanctl} deploy \
+--certificate-source custom_server \
+--certificate-server-certificate "_/root/{project-context}_cert/{project-context}_cert.pem_" \
+--certificate-server-key "_/root/{project-context}_cert/{project-context}_cert_key.pem_" \
+--certificate-server-ca-certificate "_/root/{project-context}_cert/ca_cert_bundle.pem_"
+----
+endif::[]
+ifndef::containerized[]
+----
+# {installer-scenario} \
+--certs-server-cert "/root/_{project-context}_cert/{project-context}_cert.pem_" \
+--certs-server-key "/root/_{project-context}_cert/{project-context}_cert_key.pem_" \
+--certs-server-ca-cert "/root/_{project-context}_cert/ca_cert_bundle.pem_" \
+--certs-update-server \
+--certs-update-server-ca
+----
+endif::[]
+. Deploy the new CA certificate on hosts.
+
+.Additional resources
+* {ManagingHostsDocURL}refreshing-the-self-signed-ca-certificate-on-hosts[Refreshing the self-signed CA certificate on hosts in _{ManagingHostsDocTitle}_]

guides/common/modules/proc_renewing-a-custom-server-ca-certificate.adoc

@@ -11,7 +11,7 @@ ifndef::containerized[]
 [NOTE]
 ====
 To renew the certificate authority (CA) certificate, follow a separate process to avoid disrupting connections to existing hosts.
-For more information, see xref:planning-for-self-signed-ca-certificate-renewal[].
+For more information, see xref:renewing-a-custom-server-ca-certificate[].
 ====
 endif::[]
 

guides/common/modules/proc_renewing-self-signed-certificates-on-server.adoc

@@ -2,4 +2,4 @@
 
 * Remote execution is enabled on the host.
 * The CA certificate has been changed on {ProjectServer}.
-For more information, see {AdministeringDocURL}planning-for-self-signed-ca-certificate-renewal[Planning for self-signed CA certificate renewal] in _{AdministeringDocTitle}_.
+For more information, see {AdministeringDocURL}renewing-a-custom-server-ca-certificate[Renewing a custom server CA certificate] in _{AdministeringDocTitle}_.