Skip to content

Renew TLS certificates

Renew certificates before their validity period ends. Keep the old certificate available for controlled rollback until the new certificate is verified.

Renew a private certificate

  1. Inventory every service hostname and current expiration date.
  2. Generate a new private-scope CSR through the managed application action.
  3. Verify its subject alternative names.
  4. Have the approved certificate authority sign the CSR.
  5. Upload the public leaf and required intermediate certificate chain.
  6. Wait for the managed action to complete.

  7. From each client network, set the exact deployment-provided hostname and verify hostname, chain, and expiration:

    SERVICE_HOSTNAME="<deployment-service-hostname>"

openssl s_client \
  -connect "${SERVICE_HOSTNAME}:443" \
  -servername "${SERVICE_HOSTNAME}" \
  -verify_return_error </dev/null

  8. Confirm the command ends with Verify return code: 0 (ok) and the served certificate has the expected subject alternative name, issuer, serial number, and new expiration date.

  9. Test Kibana sign-in and an Elasticsearch request.
  10. Record the new expiration date and next renewal owner.

Do not upload or distribute the deployment private key. If the certificate is rejected, confirm that it was issued from the current CSR and that the complete chain is present. If clients still receive the old certificate, confirm that the managed action completed and retry from every endpoint and network path before assuming the change propagated.