SSL Certificate Expired on OnDemand Access

[evolu-tion]

This is my first time using the hpc-toolset-tutorial. After running ./hpcts start successfully, I encountered an issue when trying to access OnDemand at https://localhost:3443. The SSL certificate appears to be expired.

Certificate chain
 0 s:C=US, ST=NY, O=HPC Tutorial, CN=localhost
   i:CN=fake-ca
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jul 14 12:28:48 2023 GMT; NotAfter: Jul 13 12:28:48 2024 GMT

Could you provide guidance on how to update or replace the expired SSL certificate?

Thank you!

[johrstrom]

As of now you have to rebuild the containers locally. That is, you can't pull what's on dockerhub.

[PaulBreugnot]

After a very hard time trying to build containers locally without success, I found this post in closed issues #189, mentioning this solution... This solves the issue with pulled images for me.

In summary:

• pull images as usual, using ./hpcts start
• run the following script from the local folder:

# Generate CA
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 100000 -sha256 -key ca.key -extensions v3_ca -out ca.crt -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/OU=YourDepartment/CN=localhost"
# Generate certificate request
openssl genrsa -out localhost.key 2048
openssl req -new -sha256 -key localhost.key -out localhost.csr -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/OU=YourDepartment/CN=localhost"
# Config for signing cert
cat > localhost.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = DNS:localhost
extendedKeyUsage = serverAuth
EOF

# Sign cert request and generate cert
openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial \
  -in localhost.csr -out localhost.crt \
  -days 100000 -sha256 -extfile localhost.ext

#Add to Docker Container
docker cp ca.key ondemand:/etc/pki/tls/
docker cp ca.crt ondemand:/etc/pki/tls/
docker cp localhost.key ondemand:/etc/pki/tls/private/
docker cp localhost.csr ondemand:/etc/pki/tls/certs/
docker cp localhost.ext ondemand:/etc/pki/tls/
docker cp localhost.crt ondemand:/etc/pki/tls/certs/
docker cp ca.crt ondemand:/etc/pki/ca-trust/source/anchors/

• ssh -p 6222 hpcadmin@localhost and then ssh ondemand
• from there, run sudo update-ca-trust extract
• docker restart ondemand