1. Certificate Requirements
The Cassandra certificate must include the following:
Key Usage
-
Client Authentication
-
Server Authentication
Subject Alternative Names (SAN)
-
All server IP addresses
-
The Cassandra DNS name
Example:
10.204.60.1
10.204.60.2
10.204.60.3
10.204.60.4
10.204.60.5
10.204.60.6
cassandra.dev.local
2. Generating the Certificate
There are two supported methods:
Option 1 — Generate a CSR
Create a configuration file for the CSR.
Example cassandra.cnf:
[ req ]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
req_extensions = req_ext
prompt = no
[ req_distinguished_name ]
C = RO
ST = RO
L = Bucharest
O = VeridiumID
OU = Veridium
CN = cassandra.dev.local
[ v3_req ]
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
[req_ext]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = 10.204.60.1
DNS.2 = 10.204.60.2
DNS.3 = 10.204.60.3
DNS.4 = 10.204.60.4
DNS.5 = 10.204.60.5
DNS.6 = 10.204.60.6
DNS.7 = cassandra.dev.local
Generate the private key and CSR:
openssl genrsa -out cassandra.key 2048
openssl req -new -key cassandra.key -out cassandra.csr -config cassandra.cnf
Send cassandra.csr to your Certificate Authority for signing.
Option 2 — Use an Existing PFX Certificate
If a .pfx file is provided containing:
-
private key
-
certificate
-
certificate chain
Convert it using:
/etc/veridiumid/scripts/convert_haproxy_cert.sh file.pfx
3. Verify the Certificate
Ensure the certificate contains the correct usages:
openssl x509 -in server.pem -text -noout | grep "Extended Key Usage" -A4
Expected output:
X509v3 Extended Key Usage:
TLS Web Server Authentication
TLS Web Client Authentication
4. Import the Intermediate Certificate
The intermediate certificate must be added to both:
-
Veridium Truststore
-
ILP Truststore
4.1 Import in WebSecAdmin
Add the certificate to the Truststore via the WebSecAdmin interface.
4.2 Import on ILP Nodes
Run on each node:
# Get Cassandra keystore password
passkeystore=$(grep '^CASSANDRA_KEYSTORE_PASS_ENV=' /etc/default/veridiumid/uba_variables | cut -d'=' -f2- | sed 's/^"//; s/"$//')
# Import intermediate certificate
keytool -importcert -keystore /opt/veridiumid/uba/TrustStore.jks -storepass "$passkeystore" -file intermediate.pem
cat intermediate.pem >> /opt/veridiumid/uba/TrustStore.pem
Update ILP truststore variable:
truststore=$(grep '^TRUSTSTORE_ENV=' /etc/default/veridiumid/uba_variables | cut -d'=' -f2- | sed 's/^"//; s/"$//')
printf '%s' "$truststore" | base64 -d > cert_ilp.pem
cat intermediate.pem >> cert_ilp.pem
# Remove old TRUSTSTORE_ENV
sed -i '/^TRUSTSTORE_ENV=/d' /etc/default/veridiumid/uba_variables
# Add new TRUSTSTORE_ENV
printf '\nTRUSTSTORE_ENV="%s"\n' "$(base64 -w0 cert_ilp.pem)" >> /etc/default/veridiumid/uba_variables
5. Configure Cassandra
Perform the following on each Cassandra node.
5.1 Prepare the Certificate Bundle
Combine the key, signed certificate, and intermediate chain:
cat cassandra.key > server.pem
cat cassandraSigned.pem >> server.pem
cat intermediate.pem >> server.pem
5.2 Define Paths and Password
CURRENT_TIMESTAMP=`date +"%Y%m%d%H%M%S%3N"`
CAS_KEYSTORE=/opt/veridiumid/cassandra/conf/KeyStore.jks
CAS_TRUSTSTORE=/opt/veridiumid/cassandra/conf/TrustStore.jks
CAS_PASS=$(grep "truststore_password" /opt/veridiumid/cassandra/conf/cassandra.yaml | awk -F' ' '{print $2}' | sort -u)
5.3 Backup Existing Stores
cp $CAS_KEYSTORE $CAS_KEYSTORE.$CURRENT_TIMESTAMP
cp $CAS_TRUSTSTORE $CAS_TRUSTSTORE.$CURRENT_TIMESTAMP
5.4 Create Keystore
openssl pkcs12 -export -in server.pem -inkey server.pem -name 'tomcat' -out KeyStore.jks -passout pass:${CAS_PASS}
5.5 Update Truststore
cp $CAS_TRUSTSTORE TrustStore.jks
ALIAS="cassandra-$(uuidgen)"
echo "yes" | keytool -import -alias $ALIAS -file intermediate.pem -storetype JKS -keystore TrustStore.jks -storepass ${CAS_PASS}
## here some errors saying that you have imported the certificate already, so it is ok not to import it.
5.6 Convert to PKCS12
keytool -importkeystore -srckeystore KeyStore.jks -destkeystore KeyStore.jks -srcstoretype jks -deststoretype pkcs12 -srcstorepass ${CAS_PASS} -keypass ${CAS_PASS} -deststorepass ${CAS_PASS} -noprompt
keytool -importkeystore -srckeystore TrustStore.jks -destkeystore TrustStore.jks -srcstoretype jks -deststoretype pkcs12 -srcstorepass ${CAS_PASS} -keypass ${CAS_PASS} -deststorepass ${CAS_PASS} -noprompt
5.7 Rolling Restart (Avoid Downtime)
Step 1 — Update Truststore
\cp TrustStore.jks ${CAS_TRUSTSTORE}
systemctl restart ver_cassandra
## run nodetool status to ensure that node is up
Perform a rolling restart across all nodes.
Step 2 — Update Keystore
\cp KeyStore.jks $CAS_KEYSTORE
systemctl restart ver_cassandra
## run nodetool status to ensure that node is up
6. Configure Elasticsearch
Reuse Cassandra keystore and truststore.
CURRENT_TIMESTAMP=`date +"%Y%m%d%H%M%S%3N"`
CAS_KEYSTORE=/opt/veridiumid/cassandra/conf/KeyStore.jks
CAS_TRUSTSTORE=/opt/veridiumid/cassandra/conf/TrustStore.jks
CAS_PASS=$(grep "truststore_password" /opt/veridiumid/cassandra/conf/cassandra.yaml | awk -F' ' '{print $2}' | sort -u)
ELK_KEYSTORE=/opt/veridiumid/elasticsearch/config/certs/KeyStore.p12
ELK_TRUSTSTORE=/opt/veridiumid/elasticsearch/config/certs/TrustStore.p12
ELK_PASS=$(/opt/veridiumid/elasticsearch/bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password)
Backup Existing Files
cp $CAS_KEYSTORE $CAS_KEYSTORE.$CURRENT_TIMESTAMP
cp $CAS_TRUSTSTORE $CAS_TRUSTSTORE.$CURRENT_TIMESTAMP
cp $ELK_KEYSTORE $ELK_KEYSTORE.$CURRENT_TIMESTAMP
cp $ELK_TRUSTSTORE $ELK_TRUSTSTORE.$CURRENT_TIMESTAMP
Replace Elasticsearch Stores
\cp $CAS_KEYSTORE $ELK_KEYSTORE
\cp $CAS_TRUSTSTORE $ELK_TRUSTSTORE
Update passwords:
keytool -storepasswd -new $ELK_PASS -keystore $ELK_KEYSTORE -storepass $CAS_PASS
keytool -storepasswd -new $ELK_PASS -keystore $ELK_TRUSTSTORE -storepass $CAS_PASS
Disable Shard Allocation
eops -x=PUT -p=/_cluster/settings -d="{\"transient\":{\"cluster.routing.allocation.enable\":\"none\"}}"
Restart Elasticsearch:
systemctl restart ver_elasticsearch
Re-enable allocation:
eops -x=PUT -p=/_cluster/settings -d="{\"transient\":{\"cluster.routing.allocation.enable\":\"all\"}}"
7. Configure Kafka (if needed)
Reuse Cassandra keystore and truststore.
Bash
CURRENT_TIMESTAMP=`date +"%Y%m%d%H%M%S%3N"`
CAS_PASS=$(grep "truststore_password" /opt/veridiumid/cassandra/conf/cassandra.yaml | awk -F' ' '{print $2}' | sort -u)
CAS_KEYSTORE=/opt/veridiumid/cassandra/conf/KeyStore.jks
CAS_TRUSTSTORE=/opt/veridiumid/cassandra/conf/TrustStore.jks
KAFKA_KEYSTORE=/opt/veridiumid/uba/kafka/certs/KeyStore.jks
KAFKA_TRUSTSTORE=/opt/veridiumid/uba/kafka/certs/TrustStore.jks
Backup Existing Files
cp $KAFKA_KEYSTORE $KAFKA_KEYSTORE.$CURRENT_TIMESTAMP
cp $KAFKA_TRUSTSTORE $KAFKA_TRUSTSTORE.$CURRENT_TIMESTAMP
Replace Kafka Stores
\cp $CAS_KEYSTORE $KAFKA_KEYSTORE
\cp $CAS_TRUSTSTORE $KAFKA_TRUSTSTORE
Check the password is the same:
Bash
echo $CAS_PASS
grep ssl.keystore.password /opt/veridiumid/uba/kafka/config/server.properties
##keytool -storepasswd -new $ELK_PASS -keystore $ELK_KEYSTORE -storepass $CAS_PASS
##keytool -storepasswd -new $ELK_PASS -keystore $ELK_TRUSTSTORE -storepass $CAS_PASS
Restart kafka
systemctl restart uba-kafka
8. Configure Filebeat and Kibana
Filebeat and Kibana must trust the same CA.
Extract the certificates from the Cassandra truststore:
CAS_TRUSTSTORE=/opt/veridiumid/cassandra/conf/TrustStore.jks
CAS_PASS=$(grep "truststore_password" /opt/veridiumid/cassandra/conf/cassandra.yaml | awk -F' ' '{print $2}' | sort -u)
keytool -list -rfc -keystore $CAS_TRUSTSTORE -storepass $CAS_PASS | awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/' > /tmp/all-certs.pem
⚠ Important
The extracted file may not include the entire chain.
If necessary, manually append:
-
intermediate certificate
-
root certificate
Otherwise Kibana and Filebeat will fail to start.
Deploy CA File
Copy the CA bundle:
\cp /tmp/all-certs.pem /opt/veridiumid/kibana/config/certs/ca.pem
\cp /tmp/all-certs.pem /opt/veridiumid/filebeat/config/certs/ca.pem
Restart services:
systemctl restart ver_kibana
systemctl restart ver_filebeat
9. Restart webapp services
ver_stop
ver_start