Skip to content

SSL certificate renewals: aholatransport.com

⚠️ Legacy (DigiCert-era). SSL certificate renewal has moved to one current, unified process — Let's Encrypt automation + Ahola Group Vault (https://vault.aholagroup.com/), ~90-day certs. See: SSL certificate renewals: Current process (2026). This page is kept for reference only.

Aholatransport.com certificate renewal

Location: GCP ➝ attracs-services-195009 ➝ Load Balancer

Certificate information: Name: ahola2022b Domain: *.aholatransport.com, aholatransport.com Type: Self managed Scope: Global In use by: attracs-services-195009-lb2-map-https

Certificate Issuer: DigiCert TLS RSA SHA256 2020 CA1 Certificate chain: DigiCert Global Root CA - Nov 10, 2031, 2:00:00 AM DigiCert TLS RSA SHA256 2020 CA1 - Apr 14, 2031, 2:59:59 AM *.aholatransport.com - Jul 11, 2023, 2:59:59 AM

Update process

Create a .pem file

Let's start with getting the required files: * aholatransport.key * star_aholatransport_com.crt * DigiCertCa.crt

Detailed instructions here: 1. Get the following certificates from Ahola IT (Vesa): 1. aholatransport.key 1. This can be in a PFX format (PKCS#12) which you will have to first decrypt: 1. openssl pkcs12 -in filename.pfx -nocerts -out aholatransport.key 1. Possibly you could add -nodes to this command so it doesn't leave the private key encrypted 2. If the password for the .pfx file was less than 4 characters or there was no password, you have to add this flag to the command: -passout pass: and when prompted for the import password, just press enter. 2. cat the file to make sure it is a PRIVATE KEY FILE and not an ENCRYPTED PRIVATE KEY FILE. If it is still encrypted, decrypt it with this command: 3. openssl rsa -in aholatransport.key -out aholatransport_unencrypted.key 2. star_aholatransport_com.crt 3. DigiCertCA.crt 2. Combine the files into a .pem file by running the following: 1. cat aholatransport.key star_aholatransport_com.crt DigiCertCA.crt > ahola_2020.pem 2. Inspect the contents of the file to make sure it conforms to the correct format. See link for help: https://www.digicert.com/kb/ssl-support/pem-ssl-creation.htm

Upload the .pem file to Github

Encrypt the .pem file with "Ansible Vault Encryption keys - frontend" (used as .vault_password_file below) that can be found in 1Password. 1. ansible-vault encrypt ahola_2020.pem --vault-password-file ../../.vault_password_file

TODO: Define what Github repository it is Copy the encrypted .pem file to the Github repository: 1. git pull origin master 2. git checkout -b new-cert-branch 3. git add cert.pem 4. git commit -m "Created new cert for xyz.com" 5. git push origin new-cert-branch

Upload the .pem file to frontend servers

Copy the certificate to frontends: 1. Edit attracs-linux-playbooks/frontend/frontend.install.yml, commenting out everything else except for frontend-files.yml line.

#- import_playbook: frontend-deps.yml
- import_playbook: frontend-files.yml
#- import_playbook: haproxy/haproxy.yml
#- import_playbook: nginx/nginx.yml
#- import_playbook: frontend-update.yml
  1. Run the frontend-install.yml with ansible:
    1. ansible-playbook --vault-password-file=frontend/.vault_password_file -i inventory/frontend.ini frontend/frontend-install.yml

Test that the SSL certificate returns valid certificate data

  1. Safely test that the new certificate works like so:
    1. Edit the attracs-linux-playbooks/frontend/haproxy/configs/attracs.cfg.j2 file by adding this to the end:
      1. Note that you have to fill in the certificate year before pasting this snippet!
#### frontend_test  #####################################################
frontend http-in-test
bind *:4443 ssl alpn h2,http/1.1 crt /etc/attracs-frontend/cert/ahola_20XX.pem
option forwardfor
http-request set-header X-HAPROXY-URL %[url]
http-request set-header X-HAPROXY-SSL %[ssl_fc]
# redirect http to https always
redirect scheme https code 302 if !{ ssl_fc }
# HSTS: 86400 sec = 1 day (bump up later if no problems arise)
http-response set-header Strict-Transport-Security max-age=86400
acl    host_amc4-nightly                             hdr(host) -i amc4-nightly.aholatransport.com
use_backend amc4-nightly                             if host_amc4-nightly
  1. Don't worry about the differing hostnames, this won't affect anything critical and it's all for testing anyways.
1. Run this ansible:
 1. ansible-playbook --vault-password-file=.vault\_password\_file -i inventory/frontend.ini -l attracs-frontend-2 frontend/haproxy/haproxy-update-config.yml
1. Test that we get a valid certificate with correct dates and DNS's:
 1. curl -v -H "Host: [amc4-nightly.aholatransport.com](http://amc4-nightly.aholatransport.com)" [https://95.216.1.224:4443](https://95.216.1.224:4443)