Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- tech:ucs [2021/04/21 09:42] – lutz
+++ tech:ucs [2023/05/04 07:16] (aktuell) – [SAML / SSO] lutz
@@ Zeile 13: / Zeile 13: @@
 <code bash>journalctl --vacuum-size=500M</code>
+===== Root-Zertifikat erneuern =====
+Sicherheitskopie aller Zertifikate anlegen und Umgebungsvariablen setzen:
+<sxh bash>
+cp -a /etc/univention/ssl /etc/univention/"ssl_$(date +%Y%m%d)"
+eval "$(ucr shell domainname ssl/default/days)"
+eval "$(ucr shell ucs/server/sso/fqdn)"
+</sxh>
+Das Root-Zertifikat erneuern:
+<sxh bash>
+cd /etc/univention/ssl/ucsCA
+openssl x509 -in CAcert.pem -out NewCAcert.pem -days "${ssl_default_days}" -sha256 \
+  -passin file:/etc/univention/ssl/password -signkey private/CAkey.pem
+mv NewCAcert.pem CAcert.pem
+</sxh>
+Alle Computer-Zertifikate erneuern:
+<sxh bash>
+cd  /etc/univention/ssl
+for i in *"${domainname}"; do univention-certificate renew -name "$i" -days "${ssl_default_days}"; done;
+univention-app update-certificates
+install -o root -g root -m 0644 ucsCA/CAcert.pem /var/www/ucs-root-ca.crt
+/usr/sbin/univention-certificate-check-validity
+update-ca-certificates -f
+</sxh>
+==== SAML / SSO ====
+Vorhandene Zertifikate ersetzen:
+<sxh bash>
+install -o root -g samlcgi -m 0644 /etc/univention/ssl/"ucs-sso.${domainname}"/cert.pem /etc/simplesamlphp/"ucs-sso.${domainname}-idp-certificate.crt"
+install -o root -g samlcgi -m 0640 /etc/univention/ssl/"ucs-sso.${domainname}"/private.key /etc/simplesamlphp/"ucs-sso.${domainname}-idp-certificate.key"
+service univention-saml restart
+</sxh>
+Das neue Zertifikat installieren:
+<sxh bash>
+ucr set umc/saml/idp-server="https://${ucs_server_sso_fqdn}/simplesamlphp/saml2/idp/metadata.php" || echo 'Failed!'
+service univention-management-console-web-server restart
+univention-run-join-scripts --force --run-scripts 92univention-management-console-web-server.inst
+</sxh>