KTU-UAT Certificate Renewal Guide

A. Upload CSR and Sign Certificate

Overview

Transfer the CSR to cont16059, elevate to the appropriate account, and sign the CSR with the internal CA to produce CRT output plus signing details for audit.

Download CSR from JIRA and place it in the CyberArk Downloads folder.

Upload CSR to cont16059:


scp Downloads/<ATTACHED-CSR-FILE-NAME> cont16059:/tmp

SSH into cont16059:
```
ssh cont16059
```
Switch to apizone:
```
su - apizone
```
Credentials (restricted)

!Password = NwQsR@404 Retrieve the password from the enterprise secrets vault or CyberArk; avoid embedding plaintext secrets in documentation.
```
<PASSWORD-REDACTED—FETCH-FROM-VAULT>
```
Gain root privileges:
```
sudo su -
```

Go to module CSR directory:


cd /home/apizone/CSR/<COUNTRY>/DTBRootCACert.pem /csr/<COUNTRY>/<MODULE-DIRECTORY>

Move CSR from /tmp:
```
mv /tmp/<ATTACHED-CSR-FILE-NAME> .
```

Sign CSR and write details to a text file:


openssl ca -policy policy_anything -in <ATTACHED-CSR-FILE-NAME> \
 -cert /home/apizone/CSR/<COUNTRY>/DTBRootCACert.pem \
 -keyfile /home/apizone/CSR/<COUNTRY>/DTBRootCA.key \
 -out <CERT-OUTPUT-FILE-NAME.crt> > certificate_name&date.txt

CA key passphrase prompt

! Enter the CA key passphrase from the vault; do not store secrets in shell history or in plaintext files.

<CA-KEY-PASSPHRASE-REDACTED>

CSR example screenshot (replace with hosted path)

Copy the contents of certificate_name&date.txt into a note and attach to the JIRA ticket for audit traceability.

B. Create and Retrieve P7B

Convert CRT to P7B with root and root CA:


openssl crl2pkcs7 -nocrl -certfile <CERT-OUTPUT-FILE-NAME.crt> \
 -certfile /home/apizone/CSR/<COUNTRY>/DTBRootCACert.pem /DTBRootCACert.pem \
 -out <P7B-OUTPUT-FILE-NAME.p7b>

Copy the P7B to /tmp:
```
cp <P7B-OUTPUT-FILE-NAME.p7b> /tmp/
```

Download the P7B to workstation:


scp cont16059:/tmp/<P7B-OUTPUT-FILE-NAME> ~/Downloads/

Attach the P7B file to the related JIRA item.

C. Generate Token (UAT)

Generate user token and write to file:
```
cert-gen-<COUNTRY>-uat <USERNAME> > token_username&date.txt
```
i Replace placeholders with actual country code and username from the approved spreadsheet.
Exit the server after token generation and store artifacts per policy.

Email Format and Attachments

Generate an email draft to share the certificate with the bank team using the internal tool “cert-mail” in the TOOL section, and fill all required fields.
Attach the generated P7B file copied from CyberArk to the email to share with the bank team.
Verify certificate/token details and recipients before sending to ensure accuracy and confidentiality.

Maintainer Notes

Images and assets

i Replace local Windows paths in img src with repo-relative or hosted URLs to ensure images render in CI/CD and docs portals.

Credentials handling

! Never embed real passwords or passphrases; fetch from CyberArk or the enterprise vault and rotate per policy.

Accessibility

i Keep <summary> text concise and meaningful so the disclosure control has a clear accessible name.