:original_name: mrs_01_0571.html

.. _mrs_01_0571:

Replacing the HA Certificate
============================

Scenario
--------

HA certificates are used to encrypt the communication between active/standby processes and HA processes to ensure the communication security. This section describes how to replace the HA certificates on the active and standby management nodes on MRS Manager to ensure the product security.

The certificate file and key file can be generated by the user.

Impact on the System
--------------------

MRS Manager needs to be restarted during the replacement and cannot be accessed or provide services at that time.

Prerequisites
-------------

-  You have obtained the **root-ca.crt** HA root certificate file and the **root-ca.pem** key file to be replaced.

-  You have prepared a password, such as **Userpwd@123**, for accessing the key file.

   To avoid potential security risks, the password must meet the following complexity requirements:

   -  The password must contain at least eight characters.
   -  The password must contain at least four types of the following characters: uppercase letters, lowercase letters, digits, and special characters (:literal:`~`!?,.:;-_'(){}[]/<>@#$%^&*+|\\=`).

Procedure
---------

#. Log in to the active management node.

#. Run the following commands to switch the user:

   **sudo su - root**

   **su - omm**

#. Run the following commands to generate **root-ca.crt** and **root-ca.pem** in the **${OMS_RUN_PATH}/workspace0/ha/local/cert** directory on the active management node:

   **sh ${OMS_RUN_PATH}/workspace/ha/module/hacom/script/gen-cert.sh --root-ca --country=**\ *country* **--state=**\ *state* **--city=**\ *city* **--company=**\ *company* **--organize=**\ *organize* **--common-name=**\ *commonname* **--email=**\ *Administrator email address* **--password=**\ *password*

   For example, run the following command: **sh ${OMS_RUN_PATH}/workspace/ha/module/hacom/script/gen-cert.sh --root-ca --country=DE --state=eur --city=ber --company=dt --organize=IT --common-name=HADOOP.COM --email=abc@dt.com --password=Userpwd@123**

   The command has been executed successfully if the following information is displayed:

   .. code-block::

      Generate root-ca pair success.

#. On the active management node, run the following command as user **omm** to copy **root-ca.crt** and **root-ca.pem** to the **${BIGDATA_HOME}/om-0.0.1/security/certHA** directory:

   **cp -arp ${OMS_RUN_PATH}/workspace0/ha/local/cert/root-ca.\* ${BIGDATA_HOME}/om-0.0.1/security/certHA**

#. Copy **root-ca.crt** and **root-ca.pem** generated on the active management node to the **${BIGDATA_HOME}/om-0.0.1/security/certHA** directory on the standby management node as user **omm**.

#. .. _mrs_01_0571__en-us_topic_0042008035_li61539631113353:

   Run the following command to generate an HA certificate and perform the automatic replacement:

   **sh ${BIGDATA_HOME}/om-0.0.1/sbin/replacehaSSLCert.sh**

   Enter the password as prompted, and press **Enter**.

   .. code-block::

      Please input ha ssl cert password:

   The HA certificate is replaced successfully if the following information is displayed:

   .. code-block::

      [INFO] Succeed to replace ha ssl cert.

#. .. _mrs_01_0571__en-us_topic_0042008035_li61839614113353:

   Run the following command to restart OMS:

   **sh ${BIGDATA_HOME}/om-0.0.1/sbin/restart-oms.sh**

   The following information is displayed:

   .. code-block::

      start HA successfully.

#. Log in to the standby management node and switch to user **omm**. Repeat step :ref:`6 <mrs_01_0571__en-us_topic_0042008035_li61539631113353>` to step :ref:`7 <mrs_01_0571__en-us_topic_0042008035_li61839614113353>`.

   Run the **sh ${BIGDATA_HOME}/om-0.0.1/sbin/status-oms.sh** command to check whether **HAAllResOK** of the management node is **Normal**. Access MRS Manager again. If MRS Manager can be accessed, the operation is successful.
