====== Runbook: Obnova certifikata ======

<WRAP round info>
**Trajanje:** ~15 minuta \\
**Uloga:** PKI operator \\
**Okidač:** Upozorenje o isteku (30/14/7 dana)
</WRAP>

----

===== Workflow =====

<mermaid>
flowchart TD
    A[Upozorenje o isteku] --> B{Ključ kompromitiran?}
    B -->|Da| C[→ Runbook za opoziv]
    B -->|Ne| D{Isti par ključeva?}
    D -->|Da| E[Re-Certification]
    D -->|Ne| F[Re-Key]
    E --> G[Novi certifikat]
    F --> H[Novi CSR]
    H --> G
    G --> I[Arhiviranje starog certifikata]
    I --> J[Deployment novog certifikata]
    J --> K[Ažuriranje monitoringa]

    style B fill:#ffebee
    style G fill:#e8f5e9
    style J fill:#e3f2fd
</mermaid>

----

===== Korak 1: Identifikacija certifikata koji ističu =====

<code bash>
# Svi certifikati s istekom < 30 dana
find /etc/ssl/certs -name "*.pem" -exec sh -c '
    enddate=$(openssl x509 -enddate -noout -in "$1" 2>/dev/null | cut -d= -f2)
    if [ -n "$enddate" ]; then
        expiry=$(date -d "$enddate" +%s 2>/dev/null)
        now=$(date +%s)
        days=$(( (expiry - now) / 86400 ))
        if [ "$days" -lt 30 ]; then
            echo "$1: $days dana"
        fi
    fi
' _ {} \;
</code>

<code powershell>
# PowerShell: Pronalaženje certifikata koji ističu
Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.NotAfter -lt (Get-Date).AddDays(30)
} | Select-Object Subject, NotAfter, Thumbprint
</code>

----

===== Korak 2: Odabir metode obnove =====

| Metoda | Kada koristiti | Prednost |
|--------|----------------|----------|
| **Re-Certification** | Ključ siguran, bez promjena | Brzo, bez re-deploya |
| **Re-Key** | Nova duljina ključa, promjena politike | Povećana sigurnost |
| **Replace** | Novi algoritam (→ PQ) | Budućnost osigurana |

----

===== Korak 3a: Re-Certification (isti par ključeva) =====

<code bash>
# Generiranje CSR-a iz postojećeg certifikata + ključa
openssl x509 -x509toreq -in old_cert.pem -signkey private.key -out renew.csr

# Izdavanje novog certifikata
openssl ca -config openssl.cnf \
    -extensions server_cert \
    -in renew.csr \
    -out renewed_cert.pem \
    -days 365 \
    -notext
</code>

----

===== Korak 3b: Re-Key (novi par ključeva) =====

<code bash>
# Generiranje novog ključa (EC P-384)
openssl ecparam -genkey -name secp384r1 -out new_private.key

# Novi CSR s istim Subjectom
openssl req -new -key new_private.key -out rekey.csr \
    -subj "$(openssl x509 -in old_cert.pem -subject -noout | sed 's/subject=//')"

# Izdavanje certifikata
openssl ca -config openssl.cnf \
    -extensions server_cert \
    -in rekey.csr \
    -out rekeyed_cert.pem \
    -days 365
</code>

----

===== Korak 3c: Replace (nadogradnja na Hybrid/PQ) =====

<code csharp>
// Migracija na hibridni način
using var oldCert = new X509Certificate2("old_cert.pfx", "password");

// Novi par ključeva (ML-DSA-65 za Hybrid)
using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);
using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384);

var request = new CertificateRequest(
    oldCert.SubjectName,
    ecdsa,
    HashAlgorithmName.SHA384);

// Preuzimanje ekstenzija
foreach (var ext in oldCert.Extensions)
    request.CertificateExtensions.Add(ext);

// Kreiranje hibridnog certifikata
var newCert = request.CreateSelfSigned(
    DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddDays(365),
    CryptoMode.Hybrid);
</code>

----

===== Korak 4: Arhiviranje starog certifikata =====

<code bash>
# Arhiviranje s metapodacima
ARCHIVE_DIR="/var/archive/certs/$(date +%Y)"
mkdir -p "$ARCHIVE_DIR"

# Certifikat + metapodaci
cp old_cert.pem "$ARCHIVE_DIR/$(openssl x509 -serial -noout -in old_cert.pem | cut -d= -f2).pem"

# Arhivski log
echo "$(date -Iseconds) RENEWED $(openssl x509 -serial -noout -in old_cert.pem)" >> /var/log/cert-archive.log
</code>

----

===== Korak 5: Deployment =====

| Sustav | Metoda deploymenta | Potreban restart |
|--------|-------------------|------------------|
| Apache | ''cp cert.pem /etc/ssl/; systemctl reload apache2'' | Ne |
| Nginx | ''cp cert.pem /etc/nginx/ssl/; nginx -s reload'' | Ne |
| IIS | ''Import-PfxCertificate; netsh http update'' | Ne |
| Kubernetes | ''kubectl create secret tls'' | Pod Restart |

<code bash>
# Apache/Nginx Reload
systemctl reload apache2
# ili
nginx -s reload

# Test veze
openssl s_client -connect server.example.com:443 -brief
</code>

----

===== Korak 6: Ažuriranje monitoringa =====

<code bash>
# Unos novog fingerprinta u monitoring
NEW_FP=$(openssl x509 -fingerprint -sha256 -noout -in renewed_cert.pem | cut -d= -f2)
echo "Novi fingerprint: $NEW_FP"

# Ažuriranje Prometheus alerta (ako je baziran na fingerprintu)
# Datum isteka u monitoringu trebao bi se automatski ažurirati
</code>

----

===== Kontrolna lista nakon obnove =====

| # | Točka provjere | Naredba | ✓ |
|---|----------------|---------|---|
| 1 | Novi certifikat aktivan | ''openssl s_client -connect host:443'' | ☐ |
| 2 | Lanac potpun | ''openssl verify -CAfile chain.pem cert.pem'' | ☐ |
| 3 | Stari certifikat arhiviran | ''ls /var/archive/certs/'' | ☐ |
| 4 | Ticket zatvoren | Sustav ticketa | ☐ |
| 5 | Monitoring ažuriran | Provjera dashboarda | ☐ |

----

===== Rješavanje problema =====

| Problem | Uzrok | Rješenje |
|---------|-------|----------|
| ''certificate has expired'' | Zaboravljen reload | Ponovno pokrenuti servis |
| ''certificate chain incomplete'' | Nedostaje intermediate | ''cat cert.pem intermediate.pem > fullchain.pem'' |
| ''hostname mismatch'' | SAN nije ažuriran | CSR s ispravnim SAN-ovima |
| Klijent ne vjeruje | CA nije u storeu | Distribuirati CA certifikat |

----

===== Povezani runbookovi =====

  * [[.:zertifikat-ausstellen|Izdavanje certifikata]] – Novi certifikati
  * [[.:zertifikat-widerrufen|Opoziv certifikata]] – Kod kompromitacije
  * [[..:automatisierung:scheduled-renewal|Automatska obnova]] – Automatizacija

----

<< [[.:zertifikat-ausstellen|← Izdavanje certifikata]] | [[.:zertifikat-widerrufen|→ Opoziv certifikata]] >>

----
//Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional//

{{tag>runbook certifikat obnova renewal operator}}