Integrate CheckMK 2.5.0p7 into enterprise CA

General
1

Hello everyone,

I have inherited a multisite CheckMK instance. After having a look around and upgrading everything, I also realized there are very old Root certificates. There self signed certificates had a thousand years validity period and only 2048 Bit keys.

I got a subordinate CA certificate for CheckMK from our enterprise Root CA and would like to integrate this to our enterprise PKI. I already added the enterprise Root and cmkSubCA certificates to the trusted certs. I replaced them on the filesystem (just for Site CA and Agent signing for now). Can I somehow trigger Check MK to regenerate site certificates?

Also what do I need to look at wehen replacing the message broker and relay CA certificates?

I appreciate any insight because I couldn’t find sufficient documentation. I understand CheckMK is a standalone system by default, but an integrated enterprise PKI would be neat. We are using the pro version.

2

You can use cmk-cert to trigger Check MK to regenerate site certificates - check the help for further details. However an own certificate isn’t supported.

# as siteuser
cmk-cert --help
cmk-cert rotate --help

Should be tested in a test enviornment first to get familiar with the process agents/remote sites/etc.

3

Thanks dabrian for the insight!
If an own ca is not supported, what would be the correct way of regenerating the integrated ca with a reasonable time?

4

Honestly I would not touch this at all. But if you have a certain reason or use case you have the option.

5

If you use the command mentioned by @dabrain like this here

mk-cert rotate site-ca --help

you will get the complete help output with also a expiry option.

usage: cmk-cert rotate [-h] [--expiry EXPIRY] [--remote-site REMOTE_SITE] [--finalize] {site,site-ca}

The 'rotate' mode can be used to replace an existing certificate with a new one. Be sure to consult the notes below on the specific steps required for each certificate type.

positional arguments:
  {site,site-ca}        Specify which certificate to rotate.

options:
  -h, --help            show this help message and exit
  --expiry EXPIRY       Specify the expiry time in days. The default expiry time is 10 years for both 'site-ca' and 'site' certificates.
  --remote-site REMOTE_SITE
                        Specify the remote site id for which you want to rotate the certificate.
  --finalize            'site-ca' certificate only -- Finalize the Site CA certificate rotation by replacing the old certificate with the new one and
                        generating a new site certificate.

Notes on rotating the available certificate types:

'site' certificate: The site certificate can be rotated directly. The new certificate will be signed by the existing Site CA certificate and take settings configured in WATO into account. After rotation, you need to reload the affected services to make use of the new certificate.

'site-ca' certificate: Rotating the Site CA certificate is a two-step process. First, a new Site CA certificate is generated and added to the trusted certificate store alongside the existing one. After reviewing and activating the pending changes in the GUI, the rotation can be finalized using 'cmk-cert rotate site-ca --finalize', which replaces the old Site CA certificate with the new one and generates a new site certificate signed by the new Site CA. After the finalization step, changes need to be activated in the GUI again to make use of the new Site CA and site certificates.
In a distributed monitoring setup, the rotation should be run from the central site to ensure that remote sites' trust stores are updated automatically.
Warning: following the Site CA certificate rotation, all agents will need to be manually re-registered to trust the updated certificate.

But as you read there is manual work needed after changing the site-ca certificate.