Iris (Signal Seeker) SSL Renewal

Author: Michelle McCausland

The steps outlined here describe how to update an ssl cert for errigal-iris.

• Login to godaddy, check the errigal-iris cert
• Go to https://www.errigal-iris.com/ and check the cert information (inspect element> security> view certificate)

• Go to aws and ensure you can find the certificate in the irisbalancer in EC2 → Northern California Region → LoadBalancer → Iris Balancer → Listeners

• Open a terminal window to Iris - 54.215.67.168
• Ensure you have access to the ppk file to access the server - located in Errigal Shared Documents\Amazon EC2\prod keys\iris.ppk
• Navigate to a directory or make a new one to contain the new CSR files.
• At this point we want to produce a public – private key pair.
• Run the following command: openssl genrsa -des3 -out mycert.key 2048
• Enter a password which will be used later
• Run the following command: openssl req -new -key mycert.key -out mycert.csr
  • Country - US
  • State - N. California
  • Company - Errigal Inc.
  • Organizational Unit Name - www.errigal-iris.com
  • Common Name - www.errigal-iris.com
• If using AWS a no pass key needs to be generated with the following: openssl rsa -in mycert.key -out mycert-nopass.key
• Enter your password to generate the file

• Log into GoDaddy > Certificates > Iris > ReKey & Manage > Rekey Certificate
• Here you will be asked to copy and paste the CSR text (vi .csr file)
• Submit and ensure this was successful
• An email will likely be sent to support@errigal.com in the next 5 minutes
• Click the link in the email, download the files.

• Now go to the SSL listener and select edit and select “Upload a new SSL certificate to AWS Identity and Access Management (IAM)”
• Then paste in the file contents as mentioned in the howto
• The last bit of information are the mappings to each fields, which are as follows:

Private Key = This is the key we generated earlier on our instance server, which we then removed the pass phrase from. Be sure to use the contents of the new file we created called mycert-nopass.key

Public Key Certificate = This is the public key file provided by Godaddy it should have your domain or key name in the actual file name

Certificate Chain = This is the bundle key file provided by Godaddy, it usually has the work bundle in the actual file name

• Now go to https://www.errigal-iris.com/ , force refresh a few times and check the cert information, it will now have the new expiry date. This might take a couple of minutes.