This section covers routine and one-off maintenance activities
Periodically SSL certificates need updating.
Ideally certificate cycling activities should be conducted during the weekly Digital maintenance window. If that is not possible, then a Change Management ticket should be raised, (even if retrospectively) b/c these are production changes.
See Jira tickets -
To perform these tasks, you will need to obtain from the Security Team, the following:
the SSL Certificate (possibly a .crt file),
the SSL private key (a .key file), and
one or moreCA intermediate certificates
All of these files should be readable in a text editor.
The new/updated certificate is updated directly on the Acquia Cloud web console.
This process should be repeated on all environments on Acquia.
It is recommended that the certificate first be applied to the dev environment so that any issues can be discovered on a non-prod resource ...
To install the new certificate:
Login to the , click Develop in top menu.
Select an Organization "City of Boston"), Application ("bostond8") and environment (e.g. "Dev").
In the left column menu, select SSL
The new/updated Digicert certificate can be loaded into the AWS Certificate Manager and then applied to various services within AWS as required.
Login to the .
Ensure you are in the us-east-1region
Navigate to the Certificate Manager.
AWS Services which used the old certificate will now use the new one without any further changes required.
04Oct2021. The registry app uses an AWS issued certificate. => This will be changed during 10/2021.
The Hub is hosted on AWS using the ElasticBeanstalk service: It is in region us-east-2.
Login to the .
Ensure you are in the us-east-2region
Navigate to the Certificate Manager.
The hub will now use the new certificate without any further changes required.
The cityofboston.gov certificate is installed on the Imperva load balancer/WAF. Digital do not need to install the certificate on the IIS server at zpcobweb01.
The wowza service on ZSTREAMING requires the updated cityofboston.gov certificate to be added/updated in the keystore.
See or
AWS hosted webapps use certificates managed by AWS. All webapps without permanent *.boston.gov URLs use AWS issued certificates.
*.digital-public.boston.gov and
*.digital-staging.boston.gov.
AWS automatically renews expiring certificates and sends out an email to [email protected]. Simply click on the approval link in the email to allow the cert to be automatically regenerated and installed.
Someone in the Digital Team needs to be in the [email protected] email group, and needs to have the AWS policy or in order to receive the emails and authorize the certificate renewal.
Email: [email protected] - [email protected] Alt: . Technical: [email protected]
Need to send Passport a copy of the certificate so that they can add it to the website (and possibly app) they host for parking in boston.
.pemClick the "Install SSL Certificate" button
Provide a sensible label (for example *.boston.gov 20xx)
Open the files provided and insert their contents into the text boxes. Note: The files will all have text in 80 char wide columns and start with text---- BEGIN CERTIFICATE/RSA KEY ----
Click the "Install" button
You should see a summary page with the old certificate (active) and the new certificate you just installed (inactive). When you are ready, you can Activate the new certificate, and then Deactivate and Remove the old certificate.
Repeat for each Acquia environment, (stage, ci, uat,dev2 & prod)
Expand the entry and click the "Reimport Certificate" button.
Cut and past the certificate parts onto the page and click "Review and Import".
Expand the entry and click the "Reimport Certificate" button.
Cut and past the certificate parts onto the page and click "Review and Import".
keytoolvodstreaming.cityofboston.govWhen you get the file back, copy it onto the certs20XX folder on the server.
During the csr generation, a new keystore (vodstreaming.cityofboston.gov.jks) was created in the certs20xx folder. This keystore needs to be copied into the conffolder and the certs loaded into it.
Restart the wowza server.
Tip: you can view the currently loaded certs using:
Tip: If you accidentally load the wrong cert into the keystore, or give the cert the wrong alias, you can remove it with:
C:\Program Files (x86)\Wowza Media Systems\Wowza Streaming Engine 4.8.17+1\bin
C:\Program Files (x86)\Wowza Media Systems\Wowza Streaming Engine 4.8.17+1\jre\bincd C:\Program Files (x86)\Wowza Media Systems\Wowza Streaming Engine 4.8.17+1
mkdir certs20XX
mkdir certs20XX\csr
cd certs20XX\csr
keytool -genkey -keysize 2048 -alias wowzaprivatekey -keyalg RSA -ext SAN=dns:vodstreaming.cityofboston.gov -keystore vodstreaming.cityofboston.gov.jks
keytool -certreq -file vodstreaming.cityofboston.gov.csr -alias wowzaprivatekey -keyalg RSA -ext SAN=dns:vodstreaming.cityofboston.gov -keystore vodstreaming.cityofboston.gov.jksEnter keystore password: password
Re-enter new password: password
What is your first and last name?
[Unknown]: vodstreaming.cityofboston.gov
What is the name of your organizational unit?
[Unknown]: DoIT
What is the name of your organization?
[Unknown]: CityOfBoston
What is the name of your City or Locality?
[Unknown]: Boston
What is the name of your State or Province?
[Unknown]: Massachusetts
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=vodstreaming.cityofboston.gov, OU=DoIT, O=CityOfBoston, L=Boston, ST=Massachusetts, C=US correct?
[no]: ycd C:\Program Files (x86)\Wowza Media Systems\Wowza Streaming Engine 4.8.17+1\conf
del vodstremaing.cityofboston.gov.jks
copy certs20xx\vodstremaing.cityofboston.gov.jks vodstremaing.cityofboston.gov.jks
keytool -import -alias DigiCertCA -trustcacerts -file ..\certs20xx\DigiCertCA.crt -keystore vodstreaming.cityofboston.gov.jks
keytool -import -alias TrustedRoot -trustcacerts -file ..\certs20xx\TrustedRoot.crt -keystore vodstreaming.cityofboston.gov.jks
keytool -import -alias wowzaprivatekey -trustcacerts -file ..\certs20xx\vodstreaming_cityofboston_gov.crt -keystore vodstreaming.cityofboston.gov.jkskeytool -list -keystore vodstreaming.cityofboston.gov.jkskeytool -delete -alias xxxxxx -keystore vodstreaming.cityofboston.gov.jks