Skip to main content

Certificate Management

NDIP requires certificates for the following domains in order to work:

  1. ndip.ornl.gov
  2. ndip-test.ornl.gov
  3. nova.ornl.gov and nova-test.ornl.gov (now only redirected to ndip[-test].ornl.gov)
  4. calvera.ornl.gov (legacy name, will not be renewed after January 2nd, 2027)

The certificates currently need to be updated once every 6 months. This will eventually be reduced to 47 days. ITSD is currently investigating options for automated certificate rotation and deployment via ServiceNow. In the meantime, there is a script that can automatically rotate certificates via CertManager at https://code.ornl.gov/rse/devops/infrastructures/cert-rotation. You should use the full-chain certificates produced by this script.

You can identify upcoming certificate expirations by connecting to the above domains with your browser or curl (among many other options) and inspecting the certificate according to your preferred tool's documentation.

Where the certificates live (Kubernetes)​

On mickey and speedy, the certificate and key for the main host are part of the Galaxy chart's values. They are ingress.tlsCert and ingress.tlsKey in the vault-encrypted k8s/galaxy/secrets-test.yml and k8s/galaxy/secrets-prod.yml in calvera. The chart turns them into the TLS Secret galaxy-tls in namespace ndip. That one Secret is used by:

  • every Ingress on the host (Galaxy, /rucio, /v0.1, /oncat, the prod extra routes, interactive tools);
  • RabbitMQ's TLS listener on prod (NodePort 30671, which Pulsars reach as amqps://ndip.ornl.gov:5672). The full chain must be included, because RabbitMQ is configured with existingSecretFullChain: true.

The legacy redirect hosts (calvera.ornl.gov, nova.ornl.gov) have their own certificates under ingress.extraHosts in secrets-prod.yml.

To renew: edit the secrets file with ansible-vault (see Deploying NDIP), replace the PEM blocks, then run galaxy-test or galaxy-k8s-prod. After a prod renewal, restart RabbitMQ so the TLS listener picks up the new certificate, one broker at a time.

The temporary VM proxy passes TLS through and needs no NDIP certificate. Only Globus on the VM has its own.

Updating a certificate (VM, legacy)​

For VM-hosted services, please review the certificate README in GitLab for details on how to create and update certificates for our domains.