Inhaltsverzeichnis

Runbook: Obnova certifikata

Trajanje: ~15 minuta
Uloga: PKI operator
Okidač: Upozorenje o isteku (30/14/7 dana)

Workflow

flowchart TD A[Upozorenje o isteku] --> B{Ključ kompromitiran?} B -->|Da| C[→ Runbook za opoziv] B -->|Ne| D{Isti par ključeva?} D -->|Da| E[Re-Certification] D -->|Ne| F[Re-Key] E --> G[Novi certifikat] F --> H[Novi CSR] H --> G G --> I[Arhiviranje starog certifikata] I --> J[Deployment novog certifikata] J --> K[Ažuriranje monitoringa] style B fill:#ffebee style G fill:#e8f5e9 style J fill:#e3f2fd

Korak 1: Identifikacija certifikata koji ističu

# Svi certifikati s istekom < 30 dana
find /etc/ssl/certs -name "*.pem" -exec sh -c '
    enddate=$(openssl x509 -enddate -noout -in "$1" 2>/dev/null | cut -d= -f2)
    if [ -n "$enddate" ]; then
        expiry=$(date -d "$enddate" +%s 2>/dev/null)
        now=$(date +%s)
        days=$(( (expiry - now) / 86400 ))
        if [ "$days" -lt 30 ]; then
            echo "$1: $days dana"
        fi
    fi
' _ {} \;
# PowerShell: Pronalaženje certifikata koji ističu
Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.NotAfter -lt (Get-Date).AddDays(30)
} | Select-Object Subject, NotAfter, Thumbprint

Korak 2: Odabir metode obnove

Metoda Kada koristiti Prednost
——–—————-———-
Re-Certification Ključ siguran, bez promjena Brzo, bez re-deploya
Re-Key Nova duljina ključa, promjena politike Povećana sigurnost
Replace Novi algoritam (→ PQ) Budućnost osigurana

Korak 3a: Re-Certification (isti par ključeva)

# Generiranje CSR-a iz postojećeg certifikata + ključa
openssl x509 -x509toreq -in old_cert.pem -signkey private.key -out renew.csr
 
# Izdavanje novog certifikata
openssl ca -config openssl.cnf \
    -extensions server_cert \
    -in renew.csr \
    -out renewed_cert.pem \
    -days 365 \
    -notext

Korak 3b: Re-Key (novi par ključeva)

# Generiranje novog ključa (EC P-384)
openssl ecparam -genkey -name secp384r1 -out new_private.key
 
# Novi CSR s istim Subjectom
openssl req -new -key new_private.key -out rekey.csr \
    -subj "$(openssl x509 -in old_cert.pem -subject -noout | sed 's/subject=//')"
 
# Izdavanje certifikata
openssl ca -config openssl.cnf \
    -extensions server_cert \
    -in rekey.csr \
    -out rekeyed_cert.pem \
    -days 365

Korak 3c: Replace (nadogradnja na Hybrid/PQ)

// Migracija na hibridni način
using var oldCert = new X509Certificate2("old_cert.pfx", "password");
 
// Novi par ključeva (ML-DSA-65 za Hybrid)
using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);
using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384);
 
var request = new CertificateRequest(
    oldCert.SubjectName,
    ecdsa,
    HashAlgorithmName.SHA384);
 
// Preuzimanje ekstenzija
foreach (var ext in oldCert.Extensions)
    request.CertificateExtensions.Add(ext);
 
// Kreiranje hibridnog certifikata
var newCert = request.CreateSelfSigned(
    DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddDays(365),
    CryptoMode.Hybrid);

Korak 4: Arhiviranje starog certifikata

# Arhiviranje s metapodacima
ARCHIVE_DIR="/var/archive/certs/$(date +%Y)"
mkdir -p "$ARCHIVE_DIR"
 
# Certifikat + metapodaci
cp old_cert.pem "$ARCHIVE_DIR/$(openssl x509 -serial -noout -in old_cert.pem | cut -d= -f2).pem"
 
# Arhivski log
echo "$(date -Iseconds) RENEWED $(openssl x509 -serial -noout -in old_cert.pem)" >> /var/log/cert-archive.log

Korak 5: Deployment

Sustav Metoda deploymenta Potreban restart
——–——————-——————
Apache cp cert.pem /etc/ssl/; systemctl reload apache2 Ne
Nginx cp cert.pem /etc/nginx/ssl/; nginx -s reload Ne
IIS Import-PfxCertificate; netsh http update Ne
Kubernetes kubectl create secret tls Pod Restart 
# Apache/Nginx Reload
systemctl reload apache2
# ili
nginx -s reload
 
# Test veze
openssl s_client -connect server.example.com:443 -brief

Korak 6: Ažuriranje monitoringa

# Unos novog fingerprinta u monitoring
NEW_FP=$(openssl x509 -fingerprint -sha256 -noout -in renewed_cert.pem | cut -d= -f2)
echo "Novi fingerprint: $NEW_FP"
 
# Ažuriranje Prometheus alerta (ako je baziran na fingerprintu)
# Datum isteka u monitoringu trebao bi se automatski ažurirati

Kontrolna lista nakon obnove

# Točka provjere Naredba ✓
——————-————
1 Novi certifikat aktivan openssl s_client -connect host:443 ☐
2 Lanac potpun openssl verify -CAfile chain.pem cert.pem ☐
3 Stari certifikat arhiviran ls /var/archive/certs/ ☐
4 Ticket zatvoren Sustav ticketa ☐
5 Monitoring ažuriran Provjera dashboarda ☐

Rješavanje problema

Problem Uzrok Rješenje
—————-———-
certificate has expired Zaboravljen reload Ponovno pokrenuti servis
certificate chain incomplete Nedostaje intermediate cat cert.pem intermediate.pem > fullchain.pem
hostname mismatch SAN nije ažuriran CSR s ispravnim SAN-ovima
Klijent ne vjeruje CA nije u storeu Distribuirati CA certifikat

Povezani runbookovi

« ← Izdavanje certifikata | → Opoziv certifikata »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional

, , , ,