regenerate certificates for a old openshift origin version , please help !

[jherreraBE]

hi,

at my work we have running a very old openshift origin version:

7514756@s51lv1q:~ $ oc version
oc v1.4.0-rc1+b4e0954
kubernetes v1.4.0+776c994
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://localhost:8443
openshift v1.4.0-rc1+b4e0954
kubernetes v1.4.0+776c994
7514756@s51lv1q:~ $ 

at this moment all our cobol developers make use of this platform to test their applications. but on 15th of December are certificates that are expired and the platform will stop working:

7514756@s51lv1q:/opt/openshift/openshift.local.config/master $  for i in *.crt;do printf "%30s : " $i; openssl x509 -in $i -noout -enddate; done
                     admin.crt : notAfter=Dec 16 14:56:34 2022 GMT
                 ca-bundle.crt : notAfter=Dec 14 13:13:15 2021 GMT
                        ca.crt : notAfter=Dec 14 13:13:15 2021 GMT
               etcd.server.crt : notAfter=Dec 16 14:56:35 2022 GMT
        master.etcd-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
     master.kubelet-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
       master.proxy-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
             master.server.crt : notAfter=Dec 16 14:56:34 2022 GMT
          openshift-master.crt : notAfter=Dec 16 14:56:34 2022 GMT
        openshift-registry.crt : notAfter=Dec 16 14:56:35 2022 GMT
          openshift-router.crt : notAfter=Dec 16 14:56:35 2022 GMT
            service-signer.crt : notAfter=Dec 14 13:13:17 2021 GMT
7514756@s51lv1q:/opt/openshift/openshift.local.config/master $ 

I have tried to regenerate the certificates with this procedure, but without success. it create a new certificates, but openshift does not start.
procedure:

• stop Openshift (systemctl)
• delete/move all .crt and .key files in both folders

7514756@s51lv1q:/opt/openshift/openshift.local.config $ ll
total 8
drwxr-xr-x 4 root root 4096 Oct 27 23:13 master
drwxr-xr-x 3 root root 4096 Oct 27 23:13 node-s51lv1q.cmcdev.be
7514756@s51lv1q:/opt/openshift/openshift.local.config $ 

!!don't delete the valid certificates !!

• start Openshift (systemctl) again.

is there something more that I need to do ?

we are migrating the enviroment to a supported Openshift enviroment ... but we are not ready yet.

thanks in advance,

kind regards,

Jonay

[jherreraBE]

hi,
i am back. this is the error we recieved when we launch openshift after removing the certificates that are almost out of date:

root@s51lv1q:~ # systemctl status  openshift -l
● openshift.service - OpenShift StartUp Script
   Loaded: loaded (/etc/systemd/system/openshift.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2021-11-17 21:01:58 CET; 1min 12s ago
  Process: 1582 ExecStart=/opt/openshift/openshift start (code=exited, status=255)
 Main PID: 1582 (code=exited, status=255)

Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.983253    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.ClusterPolicy: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.986419    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.Group: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.988811    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.ClusterPolicyBinding: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.991620    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.User: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.992436    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.OAuthAccessToken: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:57 s51lv1q.cmcdev.be openshift[1582]: E1117 21:01:57.993700    1582 cacher.go:254] unexpected ListAndWatch error: pkg/storage/cacher.go:194: Failed to list *api.PolicyBinding: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:58 s51lv1q.cmcdev.be openshift[1582]: F1117 21:01:58.506753    1582 start_allinone.go:89] Server could not start: could not reach etcd: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate signed by unknown authority
Nov 17 21:01:58 s51lv1q.cmcdev.be systemd[1]: openshift.service: main process exited, code=exited, status=255/n/a
Nov 17 21:01:58 s51lv1q.cmcdev.be systemd[1]: Unit openshift.service entered failed state.
Nov 17 21:01:58 s51lv1q.cmcdev.be systemd[1]: openshift.service failed.

but if I check the certificates, he recreated the missing certificates:

root@s51lv1q:/opt/openshift/openshift.local.config/master # for i in *.crt;do printf "%30s : " $i; openssl x509 -in $i -noout -enddate; done
                     admin.crt : notAfter=Dec 16 14:56:34 2022 GMT
                 ca-bundle.crt : notAfter=Nov 16 20:01:50 2026 GMT
                        ca.crt : notAfter=Nov 16 20:01:50 2026 GMT
               etcd.server.crt : notAfter=Dec 16 14:56:35 2022 GMT
        master.etcd-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
     master.kubelet-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
       master.proxy-client.crt : notAfter=Dec 16 14:56:34 2022 GMT
             master.server.crt : notAfter=Dec 16 14:56:34 2022 GMT
          openshift-master.crt : notAfter=Dec 16 14:56:34 2022 GMT
        openshift-registry.crt : notAfter=Dec 16 14:56:35 2022 GMT
          openshift-router.crt : notAfter=Dec 16 14:56:35 2022 GMT
            service-signer.crt : notAfter=Nov 16 20:01:50 2026 GMT
root@s51lv1q:/opt/openshift/openshift.local.config/master # 

please help.

kind regards,

Jonay

[rvanderp3]

I'm not really knowledgable on this version of origin, but the error you're seeing now is x509: certificate signed by unknown authority which could indicate that the new certs are signed by a CA that isn't known. You may need to update your CA with the ca chain that created those certs.