Description

This is a customized monitoring item. The system checks whether all certificates used by CCS expire every 5 minutes. An alarm is generated when the certificates expire.

Attribute

Parameters

Impact on the System

The system is unavailable after certificates expire. The issue must be handled promptly.

Possible Causes

• If the threshold is 1, the certificate is about to expire.
• If the threshold is 2, the certificate has expired.
• If the threshold is 3, the certificate is invalid or does not exist.

Procedure

1. Log in to ManageOne Maintenance Portal using a browser.
   • URL: https://Address for accessing the homepage of ManageOne Maintenance Portal:31943, for example, https://oc.type.com:31943
   • Default username: admin; default password: Huawei12#$

2. On the menu bar in the upper part of the page, choose Alarms > Current Alarms.
3. In the alarm list, locate the alarm to be handled, and click on the left of the alarm. The Details page is displayed.
4. Choose Location Info, obtain the host IP address, that is, the IP address of the node where the alarm is generated.

5. Use PuTTY to log in to the CCS node whose certificate is to be replaced.
   • Username: ccs
   • Password: IaaS@OS-CLOUD9!
     NOTE:

     The default password is IaaS@OS-CLOUD9!. If the system displays a message indicating that the password is incorrect, obtain the new password as required.

6. Run the following command and enter the password of user root to switch to user root:

   sudo su - root

7. Run the following command to disable user logout upon system timeout:

   TMOUT=0

8. Run the following commands to switch to the directory that contains certificate:

   cd /etc/ccs/server-cert

   ll

9. Run the following command to stop the CCS process:

   sh /etc/ccs/init-script/start_ccs_service.sh -A STOP -M VM

10. In the /etc/ccs/server-cert directory, run the following commands to modify the original certificates:

    mv ccs_ca.crt ccs_ca.crt.bak

    mv ccs_server.crt ccs_server.crt.bak

    mv ccs_server.key ccs_server.key.bak

11. Use a file transfer tool (such as WinSCP) to copy the new certificate to the /etc/ccs/server-cert directory on the current node. The certificate name must be the same as the original one.
12. Run the following command to change the owner of the certificate files to docker:

    chown docker:docker /etc/ccs/server-cert/*

    NOTE:

    New certificate files must be stored in the same directory as the existing ones.

13. Run the following command to restart CCS:

    sh /etc/ccs/init-script/start_ccs_service.sh -M VM

    View log file /var/log/ccs/ccs-init/ccs_server_check.log and check whether the certificates have taken effect or there is valid log information output.

    If the following information is displayed, the certificates have taken effect.

14. Repeat 5 to 13 on other CCS nodes.

15. If the alarm persists after the certificate is replaced, contact technical support for assistance.

Reference

None