Classification Self-Signed Certificate expired
Applies to
- NetApp Console
- Data Classification
Issue
- X.509 server certificate Is invalid/expired on Classification server
- The following command shows the SSL certificate is expired the Classification server:
* Server certificate:* subject: C=US; ST=NY; O=Company; CN=datasense; OU=Company; emailAddress=xxx@company.com* start date: Jul 10 xx:xx:xx 2024 GMT* expire date: Jul 10 xx:xx:xx 2025 GMT* issuer: C=US; ST=NY; O=Company; CN=datasense; OU=Company; emailAddress=xxx@company.com* SSL certificate verify result: self-signed certificate (18), continuing anyway.Cause
- The Classification server uses a self-signed SSL certificate for internal communications
- When this certificate expires, it may trigger security scanner alerts, even though core functionality is not affected
Solution
Run the certificate renewal script inside the nginx container to renew the Classification self-signed certificate and ensure the new certificate is used:
- Check expire date
cd /opt/netapp/Datasensecurl -s -v -k https://localhost 2>&1 | grep 'expire date'
- Generate new certificate
docker-compose --log-level ERROR run --user root --no-deps --rm -w "/data" ds_apiserver /data/tools/generate_self_signed.sh
- Restart
nginx(this command only for docker, for podman the command is different)docker service update --force `docker service ls | grep nginx | grep -v proxy | awk '{print $2}'`
- Check expire date again
cd /opt/netapp/Datasensecurl -s -v -k https://localhost 2>&1 | grep 'expire date'
- If the certificate does not update reboot the Classification server
Partner Notes
partnerNotes_text
Additional Information
additionalInformation_text
Internal Notes
internalNotes_text