Replace SSL Certificate on Apstra Server with Self-Signed One
When you boot up the Apstra server for the first time, a unique self-signed
certificate is automatically generated and stored on the Apstra server at
/user/root/etc/aos/nginx.conf.d ( (nginx.crt
is the public key for the webserver and nginx.key is the private
key.) The certificate is used for encrypting the Apstra server and REST API. It's
not for any internal device-server connectivity. Since the HTTPS certificate is not
retained when you back up the system, you must manually back up the
etc/aos folder. We support and recommend replacing the default
SSL certificate.
The directory /user/root/etc/aos/nginx.conf.d contains the actual
files nginx.crt and nginx.key writable and it
persists across in-place upgrades. This directory is
/etc/aos/nginx.conf.d is read-only because it is part of the
read-only root filesystem. This directory contains symlinks to files in the mutable
directory:
root@aos-server:/user/root/etc/aos/nginx.conf.d # ls -l /etc/aos/nginx.conf.d total 28 -rw-r--r-- 1 root root 483 Jul 6 13:08 default.extra lrwxrwxrwx 1 root root 41 Jul 6 13:08 extra.lnk -> /user/root/etc/aos/nginx.conf.d/extra.lnk -rw-r--r-- 1 root root 257 Jul 6 12:49 fips.extra -rw-r--r-- 1 root root 18639 Jul 6 12:49 nginx.conf lrwxrwxrwx 1 root root 41 Jul 6 13:08 nginx.crt -> /user/root/etc/aos/nginx.conf.d/nginx.crt lrwxrwxrwx 1 root root 41 Jul 6 13:08 nginx.key -> /user/root/etc/aos/nginx.conf.d/nginx.key
By updating the symlink targets in /user/root/etc/aos/nginx.conf.d,
and then restarting the aos_nginx_1 container,
nginx follows the symlinks at
user/root/etc/aos/nginx.conf.d/nginx.(crt|key) to locate the
new certificate and key files that the user has installed and/or generated.