Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- tech:ucs [2023/05/03 06:55] – [Root-Zertifikat erneuern] lutz
+++ tech:ucs [2023/05/04 07:16] (aktuell) – [SAML / SSO] lutz
@@ Zeile 16: / Zeile 16: @@
 ===== Root-Zertifikat erneuern =====
 Sicherheitskopie aller Zertifikate anlegen und Umgebungsvariablen setzen:
-<code bash>
+<sxh bash>
 cp -a /etc/univention/ssl /etc/univention/"ssl_$(date +%Y%m%d)"
 eval "$(ucr shell domainname ssl/default/days)"
 eval "$(ucr shell ucs/server/sso/fqdn)"
-</code>
+</sxh>
 Das Root-Zertifikat erneuern:
-<code bash>
+<sxh bash>
 cd /etc/univention/ssl/ucsCA
-openssl x509 -in CAcert.pem -out NewCAcert.pem -days "1825" -sha256 \
+openssl x509 -in CAcert.pem -out NewCAcert.pem -days "${ssl_default_days}" -sha256 \
   -passin file:/etc/univention/ssl/password -signkey private/CAkey.pem
 mv NewCAcert.pem CAcert.pem
-</code>
+</sxh>
 Alle Computer-Zertifikate erneuern:
-<code bash>
+<sxh bash>
 cd  /etc/univention/ssl
-for i in *.moppert.de; do univention-certificate renew -name "$i" -days "1825"; done;
+for i in *"${domainname}"; do univention-certificate renew -name "$i" -days "${ssl_default_days}"; done;
-</code>
+univention-app update-certificates
+install -o root -g root -m 0644 ucsCA/CAcert.pem /var/www/ucs-root-ca.crt
+/usr/sbin/univention-certificate-check-validity
+update-ca-certificates -f
+</sxh>
 ==== SAML / SSO ====
 Vorhandene Zertifikate ersetzen:
-<code bash>
+<sxh bash>
 install -o root -g samlcgi -m 0644 /etc/univention/ssl/"ucs-sso.${domainname}"/cert.pem /etc/simplesamlphp/"ucs-sso.${domainname}-idp-certificate.crt"
 install -o root -g samlcgi -m 0640 /etc/univention/ssl/"ucs-sso.${domainname}"/private.key /etc/simplesamlphp/"ucs-sso.${domainname}-idp-certificate.key"
 service univention-saml restart
-</code>
+</sxh>
 Das neue Zertifikat installieren:
-<code bash>
+<sxh bash>
 ucr set umc/saml/idp-server="https://${ucs_server_sso_fqdn}/simplesamlphp/saml2/idp/metadata.php" || echo 'Failed!'
 service univention-management-console-web-server restart
 univention-run-join-scripts --force --run-scripts 92univention-management-console-web-server.inst
-</code>
+</sxh>