Image Artist: Introducing new TLS certificates

The configure_webserver.sh script replaces the TLS certificates used by the Image Artist web server. The script is located in the nginx directory within the Image Artist installation directory.

View Available Options

To display all supported parameters:

configure_webserver.sh --help

Replace Certificates on the Image Artist Host

Use the following procedure to replace the certificates used by the Image Artist web server.

Prerequisites

• Obtain the new TLS certificate and corresponding private key.
• Ensure you know the full paths to both files.
• The account running the script must have permission to update the Image Artist certificate files.

Procedure

Run:

configure_webserver.sh \
--certificate <NEW_CERT_FILE> \
--private-key <NEW_KEY_FILE> \
--remove-old-certs \
--restart-sima

Where:

• <NEW_CERT_FILE> is the path to the new server certificate.
• <NEW_KEY_FILE> is the path to the corresponding private key.

What the Script Does

When the --restart-sima option is specified, the script:

1. Undeploys the Image Artist stack.
2. Removes the existing certificates.
3. Installs the new certificate and private key.
4. Redeploys the Image Artist stack.

The --remove-old-certs parameter is required when replacing an existing certificate installation.

Verify the Update

After the script completes:

1. Open the Image Artist web interface.
2. Confirm that the site is accessible over HTTPS.
3. Verify that the new certificate is being presented by the web server.
4. Confirm that Image Artist services are running normally.

Update Certificates on an HPC Cluster (Optional)

If Image Artist is configured to submit Batch Analysis jobs to a High-Performance Computing (HPC) cluster, update the cluster trust store so that cluster nodes trust the new Image Artist certificate.

Ubuntu-Based Systems

1. Copy the certificate authority (CA) certificate to:

    

   /usr/local/share/ca-certificates/

    

2. Update the trusted certificate store:

    

   sudo update-ca-certificates

    

Red Hat-Based Systems

1. Verify that the ca-certificates package is installed.

2. Copy the required certificate files to:

    

   /etc/pki/ca-trust/source/anchors/

    

3. Update the trusted certificate store:

    

   sudo update-ca-trust

    

    

Verify Cluster Connectivity

After updating the trust store, verify that cluster nodes can successfully establish secure HTTPS connections to the Image Artist host.