Signing a TLS certificate for mmsysmon

The mmsysmon service uses Transport Layer Security (TLS) to secure internal communication, such as REST API queries for performance monitoring.

About this task

In a Classic IBM Storage Scale cluster, mmsysmon automatically generates a self-signed TLS certificate. In the IBM Storage Scale Container Native Storage Access distribution, mmsysmon uses a Red Hat OpenShift-signed wildcard certificate.

Some organizations require TLS certificates that signed by an internal certificate authority (CA) instead of self-signed certificates to comply with security policies. The following steps explain how to replace the default self-signed certificate with a CA-signed certificate.

Procedure

Obtain a private key and certificate signing request (CSR).
By default, mmsysmon generates the following files:
- Private key: /usr/lpp/mmfs/lib/mmsysmon/private_key.pem
- CSR: /usr/lpp/mmfs/lib/mmsysmon/csr.pem
If you want to generate a new private key and CSR, run the following command:
```
openssl req -noenc -newkey rsa:4096 \
-keyout /usr/lpp/mmfs/lib/mmsysmon/private_key.pem \
-out /usr/lpp/mmfs/lib/mmsysmon/csr.pem
```
Submit the CSR to your internal CA for signing.
The CA returns a signed certificate, typically in .crt or .pem format.
Note: If the certificate is in DER format, convert it to PEM format by using the following command:
```
openssl x509 -in myCert.crt -inform der -outform pem -out myCert.pem
```
Copy the CA-signed certificate to the following location:
/usr/lpp/mmfs/lib/mmsysmon/cert.pem
This action replaces the default self-signed certificate.
Restart the mmsysmon daemon to apply the new certificate by running the following command:
```
mmsysmoncontrol restart
```
After the mmsysmon daemon is restarted, it uses the CA-signed TLS certificate for secure communication.