Automating custom certificates in 9.6.x

I have requested ability to automate certs into the BlueCat ecosystem especially now that public certs are changing their life cycle starting March 2026 to 200 days, then March 2027, 100 days then eventually down to 45days in March 2029. Now the public changes do not affect private certs but yes it would be nice to have those automations available.

DM

My coworker submitted a feature request for automated SSL Certificates - KI-026353

I think I followed that feature request.

Automation will definitely be needed by that time.

Even with our private certs we still want to automate the updates.  We can automate generating and pulling the certs from our internal CA (which also monitors and alerts when the cert is nearing expiration), so installing them in Integrity is the next step.

But to answer the orginal question, yes, it appears that the certs are in the same places in 9.6.1 as in previous versions.

https://care.bluecatnetworks.com/s/article/How-to-manually-install-CA-Certificates-on-Address-Manager-and-DNS-DHCP-Servers says that the known CA certs are in /usr/share/ca-certificates  and on  my 9.6.1 server I find certs in /usr/share/ca-certificates/mozilla so that looks correct.

The keystore is still at /opt/server/proteus/etc/keystore, which matches https://care.bluecatnetworks.com/s/detail/a8B400000008PK8EAM

The user cert is in /data/server/conf per https://care.bluecatnetworks.com/s/detail/a8B400000008OoTEAU

I currently have a KI KI-026189

What version is that supported in, Brian?  Is caCertificates used as intermediate/chain?  Restart required?

That’s on X 25.1, it is present in 9.6, but it's been enhanced in 25.1 ... it does accept a ca in the schema …. I had problems with it in the UI on the latest 25.1 build before CiscoLive so I reverted to the API
 

Would you expect this to work on 25.1.0-806.QA.bcn?  I keep getting a 500 error.

'{"status":500,"reason":"Internal Server Error","code":"UnexpectedError","message":"An unexpected error was encountered while servicing request","detail":"A MultiException has 4 exceptions.  They are:\\n1. MessageBodyReader not found for media type=application/octet-stream, type=class org.glassfish.jersey.media.multipart.FormDataMultiPart, genericType=class org.glassfish.jersey.media.multipart.FormDataMultiPart.\\n2. java.lang.IllegalStateException: Entity input stream has already been closed.\\n3. java.lang.IllegalArgumentException: While attempting to resolve the dependencies of com.bluecatnetworks.proteus.api.service.bean.ReportSettingsBean errors were found\\n4. java.lang.IllegalStateException: Unable to perform operation: resolve on com.bluecatnetworks.proteus.api.service.bean.ReportSettingsBean\\n"}'
 

Tim, I would expect that to be working in 800+ builds … I’m using B890 there

I’ve got a certificate and key generated with using the Lego ACME client.  I’m able to load the cert and key using the GUI after converting the private key with:

openssl pkey -in private.key -out converted.key

I get this response from the API:

{"status":400,"reason":"Bad Request","code":"InvalidPrivateKeyValue","message":"The value for resource field \'privateKey\' is not a valid Base64-encoded private key in PKCS#8 or PKCS#1 format"}

I’ve tried both the converted and original key.

Does anyone know the proper conversion to specify with openssl for the private key?

Also is there any way to get the private key?  The GET returns “_redacted”.  I was hoping to see what it was so I could compare the format with what I have.

Okay, I’ve made progress, my issue was in reading the cert and key files.  I’ve got that part sorted but now I need to add code to strip out the headers and trailers and separate out the server cert in the cert file.

I thought I’d check against Integrity 25 and see that I shouldn’t have to strip out the headers or the issuer cert so I’m going to have to dig into it more.  When I compare what I’m sending vs. what the GUI in 25 sends it looks the same so I’m missing something.