====== Runbook: Certifikat obnoviti ======

<WRAP round info>
**Trajanje:** ~10 minuta \\
**Uloga:** Security-Admin \\
**Ucestalost:** Svakih 90 dana (Let's Encrypt) ili godisnje
</WRAP>

Obnova TLS certifikata za Data Gateway.

----

===== Tijek rada =====

<mermaid>
flowchart TD
    A[Upozorenje o isteku] --> B{Tip certifikata?}
    B -->|Let's Encrypt| C[certbot renew]
    B -->|Interna CA| D[Novi certifikat zatraziti]
    B -->|Komercijalni| E[Kod ponuditelja obnoviti]
    C --> F[Certifikat zamijeniti]
    D --> F
    E --> F
    F --> G[Gateway ponovno pokrenuti]
    G --> H[HTTPS testirati]
    H --> I{OK?}
    I -->|Da| J[Gotovo]
    I -->|Ne| K[Stari certifikat vratiti]

    style J fill:#e8f5e9
    style K fill:#ffebee
</mermaid>

----

===== 1. Istek provjeriti =====

<code bash>
# Aktualni certifikat provjeriti
openssl s_client -connect gateway.example.com:443 -servername gateway.example.com 2>/dev/null | \
    openssl x509 -noout -dates

# Dana do isteka
echo | openssl s_client -connect gateway.example.com:443 2>/dev/null | \
    openssl x509 -noout -enddate | \
    cut -d= -f2 | \
    xargs -I {} bash -c 'echo "Dana do isteka: $(( ($(date -d "{}" +%s) - $(date +%s)) / 86400 ))"'
</code>

----

===== 2a. Let's Encrypt obnoviti =====

<code bash>
# Automatski (ako je certbot ispravno postavljen)
sudo certbot renew

# S Pre/Post-Hook za Gateway
sudo certbot renew \
    --pre-hook "systemctl stop data-gateway" \
    --post-hook "systemctl start data-gateway"

# Probni rad (bez stvarne obnove)
sudo certbot renew --dry-run
</code>

**Automatizacija preko Crona:**

<code bash>
# /etc/cron.d/certbot-gateway
0 3 * * * root certbot renew --quiet --post-hook "systemctl reload data-gateway"
</code>

----

===== 2b. Internu CA obnoviti =====

<code bash>
# CSR kreirati
openssl req -new -key gateway.key -out gateway.csr \
    -subj "/CN=gateway.example.com/O=Example Corp"

# CSR poslati CA-i (npr. preko PQ Crypto)
# -> Novi certifikat: gateway-new.crt
</code>

Pogledajte: [[..:..:..:pqcrypt:szenarien:operator:tagesgeschaeft:zertifikat-erneuern|PQ Crypto: Certifikat obnoviti]]

----

===== 2c. Komercijalni certifikat =====

1. Prijaviti se kod ponuditelja (DigiCert, GlobalSign, itd.)
2. Renewal zatraziti
3. CSR uploadati ili novo generirati
4. Validaciju provesti
5. Novi certifikat preuzeti

----

===== 3. Backup starog certifikata =====

<code bash>
# Backup kreirati
cp /opt/data-gateway/certs/gateway.pfx /opt/data-gateway/certs/gateway.pfx.bak.$(date +%Y%m%d)

# Ili za PEM
cp /opt/data-gateway/certs/cert.pem /opt/data-gateway/certs/cert.pem.bak.$(date +%Y%m%d)
</code>

----

===== 4. Novi certifikat instalirati =====

<code bash>
# PEM format
sudo cp new-cert.pem /opt/data-gateway/certs/cert.pem
sudo cp new-key.pem /opt/data-gateway/certs/key.pem
sudo chmod 600 /opt/data-gateway/certs/*.pem

# PFX format
sudo cp new-gateway.pfx /opt/data-gateway/certs/gateway.pfx
sudo chmod 600 /opt/data-gateway/certs/gateway.pfx
</code>

----

===== 5. Gateway ponovno pokrenuti =====

<code bash>
# Linux
sudo systemctl restart data-gateway

# Windows
Restart-Service -Name "DataGateway"

# Docker
docker restart gateway

# Kubernetes (Rolling Update)
kubectl rollout restart deployment/data-gateway -n data-gateway
</code>

----

===== 6. Verificirati =====

<code bash>
# Novi certifikat aktivan?
echo | openssl s_client -connect gateway.example.com:443 2>/dev/null | \
    openssl x509 -noout -subject -dates

# Health Check
curl https://gateway.example.com/health

# Potpuni SSL test
openssl s_client -connect gateway.example.com:443 -servername gateway.example.com
</code>

----

===== 7. Rollback (ako je potrebno) =====

<code bash>
# Backup vratiti
sudo cp /opt/data-gateway/certs/gateway.pfx.bak.20241215 /opt/data-gateway/certs/gateway.pfx

# Gateway ponovno pokrenuti
sudo systemctl restart data-gateway

# Verificirati
curl https://gateway.example.com/health
</code>

----

===== 8. Kontrolna lista =====

| # | Provjera | Da/Ne |
|---|-----------|---|
| 1 | Stari certifikat sacuvan | - |
| 2 | Novi certifikat valjan | - |
| 3 | Hostname se podudaraju | - |
| 4 | Certifikat instaliran | - |
| 5 | Gateway ponovno pokrenut | - |
| 6 | HTTPS radi | - |
| 7 | Monitoring obavijesten | - |

----

===== Rjesavanje problema =====

| Problem | Uzrok | Rjesenje |
|---------|---------|--------|
| ''Certificate mismatch'' | Key ne odgovara | Key ponovno generirati |
| ''Chain incomplete'' | Intermediate nedostaje | Chain-datoteku dodati |
| ''Permission denied'' | Pogresna prava | chmod 600 |
| Gateway se ne pokrece | Pogresna lozinka | appsettings.json provjeriti |

----

===== Automatski nadzor =====

Prometheus Alert za istek certifikata:

<code yaml>
- alert: GatewayCertExpiringSoon
  expr: |
    (probe_ssl_earliest_cert_expiry{job="gateway-tls"} - time()) / 86400 < 14
  for: 1h
  labels:
    severity: warning
  annotations:
    summary: "Gateway certifikat uskoro istjece"
    description: "Certifikat istjece za {{ $value | humanize }} dana."
</code>

----

===== Povezani runbookovi =====

  * [[.:tls-einrichten|TLS postavljanje]] - Inicijalna konfiguracija
  * [[..:monitoring:alerting|Alerting]] - Nadzor isteka
  * [[..:..:..:pqcrypt:szenarien:operator:tagesgeschaeft:zertifikat-erneuern|PQ Crypto: Certifikat obnoviti]]

----

<< [[.:tls-einrichten|<- TLS postavljanje]] | [[.:firewall-regeln|-> Firewall pravila]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Data Gateway Professional//

{{tag>operator runbook zertifikat renewal tls}}