SBCE 8.1.3 EMS with HA Pair

[dignoffo]

I have a certificate expiring next month on our SBCE 8.1.1 with an EMS HA pair configuration. We have generated the CSR and installed the new cert on the client and server profiles. I have been instructed I need to restart the application on each HA pair to have the certificate applied. Is this correct or is there another procedure?

 

[Wanebo]

Typically a server will not use new certs until certain services are restarted. So, yes, it's true.

 

[dignoffo]

Wanebo,

Will restarting the application for each HA pair work?

 

[Wanebo]

It's usually best to just reboot the servers so all the application services do a full clean restart.

Start by rebooting the member of the HA pair that is in standby, after that comes back up and is functioning properly, interchange the pair so the one you just rebooted becomes active, then reboot the other one (which is now the standby).

 

[dignoffo]

Wanebo,

Thank you.

 

[SPOFy]

As SBCe's are nginx based, I've gotten away with simply doing a reload nginx config without the need to restart any services. New SSL sessions establish using the new certs. Look up nginx -s reload