Using non-LCM generated certificates
About this task
Some organizations might want to generate certificates for DataStax Enterprise (DSE) servers using a commercial or enterprise certificate authority external to Lifecycle Manager (LCM). Complete the following steps to generate certificates not generated by LCM.
Procedure
-
Prior to running an installation or configuration job, prepare keystores and truststores for each node outside of LCM.
-
Deploy the appropriate keystore and truststore to each DSE server using scp, rsync, or other method of file deployment. The keystore files are commonly deployed to the
/etc/dse/keystores/directory. -
Edit the configuration profile in LCM so that the keystore and truststore paths point to the location where the files were deployed as mentioned previously. For example:
/etc/dse/keystores/server.keystoreand/etc/dse/keystores/server.truststore. -
Edit the configuration profile in LCM so that the keystore and truststore passwords allow DSE to unlock the files that were manually deployed.
-
Run an install or configure job.
When executing the job, LCM configures each DSE server to use the provided, pre-deployed keystore and truststore. LCM does not attempt to prepare certificates using the internal certificate authority when it finds a pre-existing keystore and truststore present on a DSE server.
