---

Web Certificates

---

The default web cert (/etc/pki/tls/certs/localhost.crt) expires 1 year after it is created which is when the machine is installed. There is a certwatch cronjob that will start warning of the impending expiration 30 days prior. To avoid all this, and the certificate becoming invalid, create a cert that is valid for 10 years. Since it is just self signed and only used internally by things like nagios and ganglia there shouldn't be a problem with this.

Run the following command

openssl req -new -days 3650 -x509 -nodes -out /etc/pki/tls/certs/localhost.crt -keyout /etc/pki/tls/private/localhost.key

and use the following as answers to its questions

US
NM
Socorro
NRAO
USNO
usno-serv-1
root@usno-serv-1

You can inspect the key with the following command

certtool -i --infile /etc/pki/tls/certs/localhost.crt