Bringing your own CA Certificate

You can replace the WebSphere Automation self-signed certificate authority (CA) certificate with your own CA certificate.

Prerequisites

The following PEM encoded certificate files are required:

  • ca.crt: Contains the whole certificate chain from Root to the signing CA. Signing CA is the topmost and the root CA is the last.
  • tls.crt: Contains only the signing CA.
  • tls.key: Contains the RSA private key for the signing CA.

Create your own secret

  1. Create the secret with the name wsa-custom-ca:
      oc create secret generic wsa-custom-ca \
  --namespace <instance-namespace> \
  --from-file=ca.crt=ca.crt \
  --from-file=tls.crt=tls.crt \
  --from-file=tls.key=tls.key \
  --dry-run=client -o yaml | oc apply -f -
  2. Wait for all WSA pods to restart. After the restart all certificates used by Mongo, used for registration and used by the UI will be issued by the CA set in the secret.

Use Custom CA for prerequisites

  1. For Kafka, see Renewing or replacing CA certificates and private keys with your own on the official Strimzi documentation.
  2. For Cloud Pak Foundational Services (CPFS) and Zen service, see Bringing your own CA Certificate.
  3. After you change the CPFS CA, delete the zen-ca-cert-secret to force the operator to recreate the secret by copying from the CPFS CA.

Refreshing CA chain for Red Hat Cert Manager

If you use Red Hat Cert Manage for CPFS, you can run the following command to refresh the chain since Red Hat Cert Manage does not have an equivalent of refresh-ca-chain=true in ibm cert manager.

oc get certificates -A -o jsonpath='{range .items[?(@.spec.issuerRef.name == "<issuer-name>")]}{.spec.secretName}{"\t"}{.metadata.namespace}{"\n"}{end}' | \
  xargs -n2 sh -c 'oc delete secret "$0" -n "$1"'
Note: You can set issuer-name as cs-ca-issuer for CPFS or set zen-tls-issuer for internal zen certificates.