Scope
Deploy valid certificates to all ~1400 monit agent hosts currently using self-signed certificates
Current State (2026-08-06)
- ✅ Main monit web page: Fixed (had bad cert, now valid)
- ❌ Agent pages: Still using self-signed certificates
- 🔧 Browsers show cert warnings on individual agent pages
Related Jira Tickets
- HCLPDRM-37883: Apply systemd not-fork config to production monit hosts (systemd supervision)
- HCLPDRM-37884: Add monit host config entries to clustercmd (automate deployment)
Available Tools & Examples
- CertHub API command: gcp-ssl cert type (reference in gdata-server/reference-mmonit-cert-cmd)
- Test script: dbcerts/scripts/try_monit_cert.sh.gz (gcp-ssl-client-server type)
- Bulk deploy tool: deploy_certs.pl (batch P12 deployment, SSH distribution, CertHub polling)
- Monit config: /opt/dap/apps/monit/conf/store/ (where P12 files land)
Blockers to Resolve
1. Host Inventory
Which 1400 hosts run monit?
- Likely in clustercmd or discoverable from monit agent registrations
- Production cluster.xml has full inventory (UAT cluster.xml only has 21 servers)
2. Cert Type Selection
- Main server: gcp-ssl (Server Authentication EKU) ✅
- Agents: gcp-ssl or gcp-ssl-client-server? (CLARIFY NEEDED)
- Reference: try_monit_cert.sh uses gcp-ssl-client-server
3. Deployment Parameters
- Host format: FQDN (e.g., hostname.de.db.com) ✅
- Cert path: Standard /opt/dap/apps/monit/conf/store/ on all agents? (CLARIFY)
- UAT test scope: All 21 UAT hosts or subset? (CLARIFY)
- Batch size: All 1400 at once or smaller batches? (CLARIFY)
Automation Approach (TODO)
Phase 1: Discovery
- [ ] List all monit agent hosts from production cluster.xml/clustercmd
- [ ] Confirm hostname→CN naming convention
- [ ] Test one host cert request with try_monit_cert.sh
Phase 2: Batch Request
- [ ] Generate cert requests JSON for all 1400 hosts
- [ ] Submit to CertHub in batches (determine optimal batch size)
- [ ] Poll for completion
- [ ] Collect P12 files
Phase 3: Deployment
- [ ] Use clustercmd or SSH to distribute P12 files to /opt/dap/apps/monit/conf/store/
- [ ] Restart monit service on each host
- [ ] Verify new certs loaded (spot-check 5-10 hosts)
Phase 4: Integration
- [ ] Add to dap-platform/clustercmd as automated monit cert deployment step
- [ ] Include in regular cert renewal workflow
Build & Test Strategy
Develop and prove script in UAT (21 hosts), hand to ops for production rollout.
- Script reads cluster.xml → extracts monit hosts → generates cert requests → calls deploy_certs.pl
- Test end-to-end in UAT environment
- Document for ops to run against production cluster.xml (1400 hosts)
Open Questions (Awaiting Clarification)
- Cert type for agents: gcp-ssl or gcp-ssl-client-server?
- Is /opt/dap/apps/monit/conf/store/ standard on all 1400 agents?
- UAT scope: test against all 21 UAT hosts or subset?
- Batch size: submit all 1400 cert requests at once, or in smaller batches?