# AWX 21.0.0. SSL Certificate Update/Renew **URL:** \ **Category:** Get Help\ **Tags:** awx\ **Created:** [May 10, 2024, 10:08pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745 "2024-05-10T22:08:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![razorsim](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@razorsim](https://forum.ansible.com/u/razorsim)\ **Post date:** [May 10, 2024, 10:08pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/1 "2024-05-10T22:08:19Z")
I’ve been searching high and low on how to update TLS/SSL certificates (post AWX deployment) for AWX 21.0.0.0. I haven’t come across a guide on this topic. These are the pods running: ```auto $ kubectl get pods -n awx NAME READY STATUS RESTARTS AGE awx-registry 1/1 Running 5 (327d ago) 723d awx-postgres-0 1/1 Running 5 (327d ago) 723d awx-registry-pr 1/1 Running 4 (327d ago) 617d awx-55ccbf9f66-vdqfz 4/4 Running 20 (327d ago) 723d awx-operator-controller-manager-675865446d-cs7vf 2/2 Running 15 (327d ago) 724d ``` Any and all help would be greatly appreciated! Thank you in advance! ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [May 11, 2024, 6:06am UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/2 "2024-05-11T06:06:03Z")
If you installed via the most excellent `awx-on-k3`, add your `tls.{crt,key}` to the `base/` directory, as you might have done during installation, and from its parent directory run ```auto kubectl apply -k base ``` I presume that for other install methods the procedure is similar. ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [May 11, 2024, 1:28pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/3 "2024-05-11T13:28:34Z")
Hi, the key is, and what @jpmens stated is, updating the `tls.crt` and `tls.key` of the Secret resource that used by your Ingress resouce. If the certificates you are referring to are not the one used by Ingress resouce, please tell me which one you are referring to. ---
**Author:** ![razorsim](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@razorsim](https://forum.ansible.com/u/razorsim)\ **Post date:** [May 11, 2024, 3:50pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/4 "2024-05-11T15:50:27Z")
Thank you. I found the base directory can I can see the previous CSR. However, when I look at the it-awx-tls-secret.yml file the tls.crt and tls.secret values do not match the values in the .pem and .key file. After I generate a new certificate, how do I populate the respective .crt and .key in the awx-tls-secret.yml file? Thanks for all your help! Below are files I found in the base directory from the previous maintainer: ```auto -rw-r--r-- 1 1889601905 1889601905 1890 May 17 2022 it-awx-ssl.cer -rw-rw-r-- 1 1889601905 1889601905 1700 May 17 2022 it-awx-ssl.csr -rw------- 1 1889601905 1889601905 3414 May 17 2022 it-awx-ssl.key -rw------- 1 1889601905 1889601905 1675 May 17 2022 it-awx-ssl.pem -rw------- 1 1889601905 1889601905 3243 May 17 2022 it-awx-ssl_decr.key -rw-rw-r-- 1 1889601905 1889601905 6972 May 17 2022 it-awx-tls-secret.yml -rw-rw-r-- 1 1889601905 1889601905 6972 Aug 31 2022 it-awx-tls.yml ``` ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [May 13, 2024, 2:32pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/5 "2024-05-13T14:32:39Z")
It’s difficult to know what the previous maintainer did, and to be honest it looks to me as though they tried all manner of things … 😉 If you have the new certificate, which you might have created from an existing CSR, then you’ll probably not have to replace the `.key` as it remains identical. The certificate will probably be a PEM encoded file (`-- BEGIN CERTIFICATE --`) which goes in the `.pem` file. Before overwriting that, you can compare its content with the `.cer` file (possibly DER-encoded on Windows?) If `file it*.cer` says something like `binary` or `data`, then: ```console $ openssl x509 -in it-awx-ssl.cer -inform der -noout -subject ``` will show you the certificate subject. If it’s not a binary/data file, omit `-inform der` (or replace by `-inform pem`). You can compare with the `*.pem` file by replacing the `-in` file in above command. ---
**Author:** ![razorsim](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@razorsim](https://forum.ansible.com/u/razorsim)\ **Post date:** [May 13, 2024, 6:15pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/6 "2024-05-13T18:15:59Z")
Thank you so much for your suggestions. Yes, it’s hard to get into someone’s mind - especially when they are no longer around. There wasn’t a design spec or document containing a how-to for updating the SSL cert. Moving forward, I’ll take an offline snapshot of the VM - just in case things go sideways I can easily rollback. ---
**Author:** ![razorsim](https://avatars.discourse-cdn.com/v4/letter/r/9fc348/32.png) [@razorsim](https://forum.ansible.com/u/razorsim)\ **Post date:** [May 17, 2024, 11:01pm UTC](https://forum.ansible.com/t/awx-21-0-0-ssl-certificate-update-renew/5745/7 "2024-05-17T23:01:52Z")
> [@jpmens](#): > > `kubectl apply -k base` What does the apply command do exactly? I understand it applies the config in kustomize.config. But the first resource in the config file is a repo (see below from my cat output). Does it pull and install the latest operator version? ```auto apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: # Find the latest tag here: https://github.com/ansible/awx-operator/releases - github.com/ansible/awx-operator/config/default?ref=0.21.0 - it-awx.yml # Set the image tags to match the git version from above images: - name: quay.io/ansible/awx-operator newTag: 0.21.0 # Specify a custom namespace in which to install AWX namespace: awx ``` I get the following error now when syncing inventory ```auto May 17 00:15:48 hq-it-awx k3s[3864180]: I0517 00:15:48.422518 3864180 kubelet_pods.go:891] "Unable to retrieve pull secret, the image pull may not succeed." pod="awx/awx-operator-controller-manager-675865446d-cs7vf" secret="" err="secret \"redhat-operators-pull-secret\" not found" ```