Configure SSL for OCP

# View Certificate Details (ocp.cer as an Example)
openssl x509 -in ocp.cer -text -noout

# Pay special attention to the following fields:
# - Not After: Certificate expiration date
# - Subject Alternative Name (SAN): Whether it contains the access domain name or IP address of OCP.

openssl pkcs12 -export \
    -in ocp.cer \
    -inkey ocp.key \
    -certfile ca.cer \
    -name ocp \
    -out ocp.keystore \
    -passout pass:<your_keystore_password>

UPDATE `config_properties` SET `value`='8443' WHERE `key`='server.port';
UPDATE `config_properties` SET `value`='true' WHERE `key`='server.ssl.enabled';
UPDATE `config_properties` SET `value`='ocp' WHERE `key`='server.ssl.key-alias';
UPDATE `config_properties` SET `value`='key_pswd' WHERE `key`='server.ssl.key-password';
UPDATE `config_properties` SET `value`='/home/admin/data/keystore/ocp.keystore' WHERE `key`='server.ssl.key-store';
UPDATE `config_properties` SET `value`='store_pswd' WHERE `key`='server.ssl.key-store-password';
UPDATE `config_properties` SET `value`='PKCS12' WHERE `key`='server.ssl.key-store-type';

UPDATE `config_properties` SET `value`='https://<OCP access address>:8443' WHERE `key`='ocp.site.url';

-v /data/ocp/keystore:/home/admin/data/keystore

#!/bin/bash
set -euo pipefail

# ===================== Configuration section =====================
domain="ocp.oceanbase.com"
ips="30.142.17.125"
root_password='root4321'
ocp_password="Oceanbase4321"
validity_days=3650
# ==================================================

# Check whether keytool is available.
if ! command -v keytool &> /dev/null; then
    echo "keytool not found. Please install JDK and ensure JAVA_HOME is correctly set."
    exit 1
fi

echo "Using keytool: $(which keytool)"
echo "Domain: ${domain}"
echo "IPs:    ${ips}"

# Build DN and SAN
dname="CN=${domain}"
san="SAN=DNS:${domain}"
for ip in ${ips}; do
    san="${san},IP:${ip}"
done

# ---------- 1. Generate the root CA certificate ----------
echo ">>> [1/8] Generating root CA certificate..."
keytool -genkeypair \
    -keyalg RSA -keysize 4096 \
    -dname "CN=OCP Root CA" \
    -alias root \
    -keystore root.keystore \
    -storetype PKCS12 \
    -storepass "${root_password}" \
    -ext BasicConstraints=CA:TRUE \
    -ext KeyUsage=keyCertSign,cRLSign

# ---------- 2. Generate an OCP server key pair ----------
echo ">>> [2/8] Generating OCP TLS key pair..."
keytool -genkeypair \
    -keyalg RSA -keysize 4096 \
    -validity ${validity_days} \
    -dname "${dname}" \
    -alias ocp \
    -keystore ocp.keystore \
    -storetype PKCS12 \
    -storepass "${ocp_password}" \
    -ext "${san}"

# ---------- 3. Create a Certificate Signing Request (CSR) ----------
echo ">>> [3/8] Creating CSR..."
keytool -certreq \
    -file server.csr \
    -alias ocp \
    -keystore ocp.keystore \
    -storepass "${ocp_password}" \
    -ext "${san}"

# ---------- 4. Issue server certificates with the root CA ----------
echo ">>> [4/8] Issuing server certificate under root CA..."
keytool -gencert \
    -infile server.csr \
    -outfile server.cer \
    -alias root \
    -keystore root.keystore \
    -storepass "${root_password}" \
    -ext "${san}" \
    -rfc

# ---------- 5. Export the root certificate (DER) ----------
echo ">>> [5/8] Exporting root certificate..."
keytool -exportcert \
    -file root.cer \
    -alias root \
    -keystore root.keystore \
    -storepass "${root_password}"

# ---------- 6. Import the root certificate into the OCP keystore ----------
# You must import the root certificate first so that the certificate chain can be verified when importing server certificates later.
echo ">>> [6/8] Import the root certificate to the OCP keystore..."
keytool -importcert \
    -file root.cer \
    -alias root \
    -keystore ocp.keystore \
    -storepass "${ocp_password}" \
    -noprompt

# ---------- 7. Import the issued server certificate into the OCP keystore ----------
echo ">>> [7/8] Importing the issued server certificate..."
keytool -importcert \
    -file server.cer \
    -alias ocp \
    -keystore ocp.keystore \
    -storepass "${ocp_password}"

# ---------- 8. Export the root certificate in PEM format (for client trust) ----------
echo ">>> [8/8] Exporting the PEM format root certificate..."
keytool -exportcert \
    -file root.pem \
    -alias root \
    -keystore root.keystore \
    -storepass "${root_password}" \
    -rfc

# ---------- Clean up temporary files ----------
rm -f server.csr server.cer root.cer

echo "Certificate generation completed! Output file:"
echo "  ocp.keystore  - For use by OCP Server (including the complete certificate chain)"
echo "  root.pem      - Client adds trust for use"

chmod +x gen_ocp_tls.sh
./gen_ocp_tls.sh

ips="30.142.17.125 10.0.0.1 192.168.1.100"

# RHEL series
sudo cp root.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# Debian series
sudo cp root.pem /usr/local/share/ca-certificates/root.crt
sudo update-ca-certificates

# SUSE series
sudo cp root.pem /usr/share/pki/trust/anchors
sudo update-ca-certificates