Updating SSL Certificates
Periodically SSL certificates need updating.
Last updated
Was this helpful?
Periodically SSL certificates need updating.
Last updated
Was this helpful?
Ideally certificate cycling activities should be conducted during the weekly Digital maintenance window. If that is not possible, then a Change Management ticket should be raised, (even if retrospectively) b/c these are production changes.
See Jira tickets -
To perform these tasks, you will need to obtain from the Security Team, the following:
the SSL Certificate (possibly a .crt file),
the SSL private key (a .key file), and
one or moreCA intermediate certificates (possibly .pem files).
(If there are multiple intermediate certs, you can cut and paste them into a single file with each cert starting on a new line below the old cert. The order is not important.)
All of these files should be readable in a text editor.
The new/updated certificate is updated directly on the Acquia Cloud web console.
This process should be repeated on all environments on Acquia.
It is recommended that the certificate first be applied to the dev environment so that any issues can be discovered on a non-prod resource ...
To install the new certificate:
Select an Organization "City of Boston"), Application ("bostond8") and environment (e.g. "Dev").
In the left column menu, select SSL
Click the "Install SSL Certificate" button
Provide a sensible label (for example *.boston.gov 20xx)
Open the files provided and insert their contents into the text boxes. Note: The files will all have text in 80 char wide columns and start with text---- BEGIN CERTIFICATE/RSA KEY ----
Click the "Install" button
You should see a summary page with the old certificate (active) and the new certificate you just installed (inactive). When you are ready, you can Activate the new certificate, and then Deactivate and Remove the old certificate.
Repeat for each Acquia environment, (stage, ci, uat,dev2 & prod)
The new/updated Digicert certificate can be loaded into the AWS Certificate Manager and then applied to various services within AWS as required.
Ensure you are in the us-east-1region
Navigate to the Certificate Manager.
Locate the *.boston.gov certificate in the list. Importantly: The correct entry will have a Type=Imported.
Expand the entry and click the "Reimport Certificate" button.
Cut and past the certificate parts onto the page and click "Review and Import".
AWS Services which used the old certificate will now use the new one without any further changes required.
04Oct2021. The registry app uses an AWS issued certificate. => This will be changed during 10/2021.
The Hub is hosted on AWS using the ElasticBeanstalk service: It is in region us-east-2.
Ensure you are in the us-east-2region
Navigate to the Certificate Manager.
Locate the *.boston.gov certificate in the list. Importantly: The correct entry will have a Type=Imported.
Expand the entry and click the "Reimport Certificate" button.
Cut and past the certificate parts onto the page and click "Review and Import".
The hub will now use the new certificate without any further changes required.
The cityofboston.gov certificate is installed on the Imperva load balancer/WAF. Digital do not need to install the certificate on the IIS server at zpcobweb01.
The wowza service on ZSTREAMING requires the updated cityofboston.gov certificate to be added/updated in the keystore.
AWS hosted webapps use certificates managed by AWS. All webapps without permanent *.boston.gov URLs use AWS issued certificates.
*.digital-public.boston.gov and
*.digital-staging.boston.gov.
AWS automatically renews expiring certificates and sends out an email to webmaster@boston.gov. Simply click on the approval link in the email to allow the cert to be automatically regenerated and installed.
Need to send Passport a copy of the certificate so that they can add it to the website (and possibly app) they host for parking in boston.
Login to the , click Develop in top menu.
Login to the .
Login to the .
See or
Note: after the keytool -genkey command you will be prompted for information, the correct field values are:
Someone in the Digital Team needs to be in the webmaster@boston.gov email group, and needs to have the AWS policy or in order to receive the emails and authorize the certificate renewal.
Email: james_loper@passportinc.com - support@passportinc.com Alt: . Technical: jeremy.proffitt@passportinc.com
