Update certificates

Update certificates in a Redis Enterprise cluster.

How to update certificates

You can use the rladmin command-line interface (CLI) or the REST API to update certificates. The Cluster Manager UI lets you update proxy and syncer certificates on the Cluster > Security > Certificates screen.

The new certificates are used the next time the clients connect to the database.

When you upgrade Redis Enterprise Software, the upgrade process copies the certificates that are on the first upgraded node to all of the nodes in the cluster.

Use the Cluster Manager UI

To replace proxy or syncer certificates using the Cluster Manager UI:

1. Go to Cluster > Security > Certificates.

2. Expand the section for the certificate you want to update:

   • For the proxy certificate, expand Server authentication.
   • For the syncer certificate, expand Replica Of and Active-Active authentication.
   

3. Click Replace Certificate to open the dialog.

   

4. Upload the key file.

5. Upload the new certificate.

6. Click Save.

Use the CLI

To replace certificates with the rladmin CLI, run the cluster certificate set command:

 rladmin cluster certificate set <cert-name> certificate_file <cert-file-name>.pem key_file <key-file-name>.pem

Replace the following variables with your own values:

• <cert-name> - The name of the certificate you want to replace. See the certificates table for the list of valid certificate names.
• <cert-file-name> - The name of your certificate file
• <key-file-name> - The name of your key file

For example, to replace the Cluster Manager UI (cm) certificate with the private key key.pem and the certificate file cluster.pem:

rladmin cluster certificate set cm certificate_file cluster.pem key_file key.pem

Use the REST API

To replace a certificate using the REST API, use PUT /v1/cluster/update_cert:

PUT https://[host][:port]/v1/cluster/update_cert
    '{ "name": "<cert_name>", "key": "<key>", "certificate": "<cert>" }'

Replace the following variables with your own values:

• <cert_name> - The name of the certificate to replace. See the certificates table for the list of valid certificate names.

• <key> - The contents of the *_key.pem file

  Tip:

  The key file contains \n end of line characters (EOL) that you cannot paste into the API call. You can use sed -z 's/\n/\\\n/g' to escape the EOL characters.

• <cert> - The contents of the *_cert.pem file

Replica Of database certificates

This section describes how to update certificates for Replica Of databases.

Update proxy certificates

To update the proxy certificate on clusters running Replica Of databases:

1. Use the Cluster Manager UI, rladmin, or the REST API to update the proxy certificate on the source database cluster.

2. From the Cluster Manager UI, update the destination database (replica) configuration with the new certificate.

Active-Active database certificates

Update proxy certificates

To update proxy certificate on clusters running Active-Active databases:

1. Use the Cluster Manager UI, rladmin, or the REST API to update proxy certificates on a single cluster, multiple clusters, or all participating clusters.

2. Use the crdb-cli utility to update Active-Active database configuration from the command line. Run the following command once for each Active-Active database residing on the modified clusters:

   crdb-cli crdb update --crdb-guid <CRDB-GUID> --force
   

Update syncer certificates

To update your syncer certificate on clusters running Active-Active databases, follow these steps:

1. Update your syncer certificate on one or more of the participating clusters using the Cluster Manager UI, rladmin, or the REST API. You can update a single cluster, multiple clusters, or all participating clusters.

2. Update the Active-Active database configuration from the command line with the crdb-cli utility. Run this command once for each Active-Active database that resides on the modified clusters:

   crdb-cli crdb update --crdb-guid <CRDB-GUID> --force