Regenerating the server self-signed SSL certificates
====================================================

If the PEM backend database server certificates are near expiring, plan
to regenerate the certificates and key files.

To replace the self-signed SSL certificates:

1. Stop all running PEM agents, first on the server host and then on any
   monitored host. - On Linux:

.. code:: shell

        # Running as root
        systemctl stop pemagent

-  On Windows: Use the Services applet to stop the PEM agent. The PEM
   agent service is named Postgres Enterprise Manager Agent. In the
   Services dialog box, select the service name, and select **Stop the
   service**.

1. Back up the existing SSL certificates and keys:

.. code:: shell

      cd /var/lib/edb/as<x>/data
      mkdir certs
      mv server.* root.* ca_* certs/

1. Use the ``openssl`` command to generate the ``ca_key.key`` file:

.. code:: shell

      openssl genrsa -out ca_key.key 4096 

1. Move the ``ca_key.key`` file to the data directory of the backend
   server, and change the permissions:

.. code:: shell

      mv ca_key.key /var/lib/edb/as<x>/data
      chmod 600 /var/lib/edb/as<x>/data/ca_key.key

1. Use ``ca_key.key`` to generate the ``ca_certificate.crt`` file:

.. code:: shell

      openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout ca_key.key -out ca_certificate.crt

1. Change the permissions of the ``ca_certificate.crt`` file:

.. code:: shell

      chmod 600 /var/lib/edb/as<x>/data/ca_certificate.crt

1. Reuse the ``ca_certificate.crt`` file as the ``root.crt`` file:

.. code:: shell

      cp /var/lib/edb/as<x>/data/ca_certificate.crt /var/lib/edb/as<x>/data/root.crt

1. Change the owner and permissions on the ``root.crt`` file:

.. code:: shell

      chown enterprisedb /var/lib/edb/as<x>/data/root.crt
      chmod 600 /var/lib/edb/as<x>/data/root.crt

1. Use the ``openssl_rsa_generate_crl()`` function to create the
   certificate revocation list ``root.crl`` :

.. code:: shell

      psql -U enterprisedb -d pem --no-psqlrc -t -A -c
      "SELECT openssl_rsa_generate_crl(/var/lib/edb/as<x>/data/ca_certificate.crt, /var/lib/edb/as<x>/data/ca_key.key)" > /var/lib/edb/as<x>/data/root.crl

1. Change the ownership and permissions of the ``root.crl`` file:

.. code:: shell

      chown enterprisedb /var/lib/edb/as<x>/data/root.crl
      chmod 600 /var/lib/edb/as<x>/data/root.crl

1. Use the ``openssl`` command to generate the ``server.key`` file:

.. code:: shell

      openssl genrsa -out server.key 4096 

1. Move the ``server.key`` to the data directory of the backend server,
   and change the ownership and permissions:

.. code:: shell

      mv server.key /var/lib/edb/as<x>/data
      chown enterprisedb /var/lib/edb/as<x>/data/server.key
      chmod 600 /var/lib/edb/as<x>/data/server.key

1. Use the ``openssl req`` command to create the CSR:

.. code:: shell

      openssl req -new -key server.key -out server.csr -subj /C=IN/ST=MH/L=Pune/O=EDB/CN=PEM

Where ``-subj`` is provided as per your requirements. You define ``CN``
asthe hostname/domain name of the PEM server host.

1. Use the ``openssl x509`` command to sign the CSR and generate a
   server certificate. Move the ``server.crt`` to the data directory of
   the backend database server:

.. code:: shell

      openssl x509 -req -days 365 -in server.csr -CA ca_certificate.crt -CAkey ca_key.key -CAcreateserial -out server.crt
      mv server.crt /var/lib/edb/as<x>/data

Where ``-req`` indicates the input is a CSR. The ``-CA`` and ``-CAkey``
options specify the root certificate and private key to use for signing
the CSR.

1. Change the owner and the permissions on the ``server.crt`` file:

.. code:: shell

      chown enterprisedb /var/lib/edb/as<x>/data/server.crt
      chmod 600 /var/lib/edb/as<x>/data/server.crt

1. Restart the PEM server:

``shell    systemctl restart edb-as-<x>`` Restarting the backend
database server restarts the PEM server.

1. Regenerate each PEM agent’s self-signed SSL certificates. For more
   information, see :ref:`Regenerating agent SSL certificates <Regenerating the agent self-signed SSL certificates>`  .