Yash Verma / Cloud runbook

TLS certificate about to expire

A certificate needs renewing before browsers and clients start rejecting it. All playbooks.

Check the dates on the certificate the server is actually serving.
Check a remote TLS certificate's expiry

Fetches and displays the expiration date of a remote SSL certificate.
```
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
```
ssl, tls, certificate
Create a new key and certificate signing request for your CA.
Generate CSR and private key

Creates a new 2048-bit RSA private key and a Certificate Signing Request.
```
openssl req -new -newkey rsa:2048 -nodes -keyout mydomain.key -out mydomain.csr
```
The private key is written unencrypted (-nodes); keep mydomain.key private.

ssl, openssl, csr
Check the new certificate's subject, alternative names and dates.
Read a local certificate file

Reads an x509 certificate file and outputs its details.
```
openssl x509 -in certificate.crt -text -noout
```
ssl, openssl, verify
After installing it, test the Nginx configuration.
Test Nginx configuration

Tests the Nginx config files for syntax errors before reloading.
```
sudo nginx -t
```
nginx, config, test
Reload Nginx without dropping connections, then check the served dates again.
Reload Nginx gracefully

Reloads the Nginx configuration without dropping active connections.
```
sudo nginx -s reload
```
nginx, reload