Skip to content

SSL certificate renewals: Updating certificates attracs/ahola in Hetzner

⚠️ Legacy (DigiCert-era). SSL certificate renewal has moved to one current, unified process — Let's Encrypt automation + Ahola Group Vault (https://vault.aholagroup.com/), ~90-day certs. See: SSL certificate renewals: Current process (2026). This page is kept for reference only.

Questions: Where are the private key and certificates located? What server/servers are used here? Where are the SSL certificates stored? Which certificates are handled? What does "make sure pem looks nice" actually mean? Is aholatransport.key same as attracs_2022.key?

prepare .PEM -file

Create .PEM from Private Key and certificates (https://www.digicert.com/kb/ssl-support/pem-ssl-creation.htm) for example:

cat aholatransport.key star_aholatransport_com.crt DigiCertCA.crt > ahola_2020.pem

Make sure pem looks nice, includes all newlines etc.

Encrypt .pem with frontend vault file, for example:

ansible-vault encrypt ahola_2020.pem --vault-password-file ../../.vault_password_file

and copy file to: https://github.com/Attracs/attracs-linux-playbooks/tree/master/frontend/files/cert

Copy certificate to frontends

Comment everything from frontend-install.yml excep frontend-files.yml. Run frontend-install.yml, for example:

ansible-playbook --vault-password-file=frontend/.vault_password_file -i inventory/frontend.ini  frontend/frontend-install.yml

Test new certificate before applying it to production

Edit https://github.com/Attracs/attracs-linux-playbooks/blob/master/frontend/haproxy/configs/attracs.cfg.j2 to include test site in different port:

#### frontend_test  #####################################################
frontend http-in-test
    bind *:4443 ssl alpn h2,http/1.1 crt /etc/attracs-frontend/cert/aholatransport_2020.pem
    option forward
for
    http-request set-header X-HAPROXY-URL %[url]
    http-request set-header X-HAPROXY-SSL %[ssl_fc]
    # redirect http to https always
    redirect scheme https code 302 if !{ ssl_fc }
    # HSTS: 86400 sec = 1 day (bump up later if no problems arise)
    http-response set-header Strict-Transport-Security max-age=86400
    acl    host_amc4-nightly                             hdr(host) -i amc4-nightly.aholatransport.com
    use_backend amc4-nightly                             if host_amc4-nightly

Update with :

ansible-playbook --vault-password-file=.vault_password_file -i inventory/frontend.ini -l attracs-frontend-2 frontend/haproxy/haproxy-update-config.yml

or add -l option to limit only one host first.

Test with:

curl -v -H "Host: amc4-nightly.aholatransport.com" https://95.216.1.224:4443

Update production certificate Edit https://github.com/Attracs/attracs-linux-playbooks/blob/master/frontend/haproxy/configs/attracs.cfg.j2 bind lines to match correct certificate.

  • attracs.cfg.j2
  • internal.cfg.j2
  • meshmoon.cfg.j2

All 3 need to be updated to use newest certificate.

Update attracs with:

ansible-playbook --vault-password-file=.vault_password_file -i inventory/frontend.ini frontend/haproxy/haproxy-update-config.yml

or add -l option to limit only one host first.

Update internal with:

scripts/frontend-update-configs-limit-internal1.sh

Update meshmoon with:

scripts/frontend-update-configs-limit-meshmoon1.sh

Update azure api-2 with:

scripts/frontend-update-configs-limit-devops-3.sh

Commit attracs.cfg.j2, internal.cfg.j2, meshmoon.cfg.j2 and certificate to github