---
# System prepended metadata

title: OpenShift 憑證檢查

---

# OpenShift 憑證檢查

## OpenShift 4 憑證檢查
1. Get all certificate

```
echo -e "NAMESPACE\tNAME\tEXPIRY" && oc get secrets -A -o go-template='{{range .items}}{{if eq .type "kubernetes.io/tls"}}{{.metadata.namespace}}{{" "}}{{.metadata.name}}{{" "}}{{index .data "tls.crt"}}{{"\n"}}{{end}}{{end}}' | while read namespace name cert; do echo -en "$namespace\t$name\t"; echo $cert | base64 -d | openssl x509 -noout -enddate; done | column -t > cert_expiry_date.txt
```

```
 oc get secrets -A -o go-template='{{range .items}}{{if eq .type "kubernetes.io/tls"}}{{.metadata.namespace}}{{" "}}{{.metadata.name}}{{" "}}{{index .data "tls.crt"}}{{"\n"}}{{end}}{{end}}' | while read namespace name cert; do echo " "; echo -en "Namespace: $namespace\t\nCertificateName: $name\t\n";echo " "; echo $cert | base64 -d; done &> Certificates.txt
```

2. Check etcd certificate

```
oc get no -l node-role.kubernetes.io/master --no-headers -o name | xargs -I {} --  oc debug {} -- bash -c 'for p in 2379 2380 9979 ;do openssl s_client -connect localhost:$p -showcerts 2>/dev/null | openssl x509 -noout -subject -startdate -enddate ;done' > etcd_cert.txt
```

3. Get must-gather
```
oc adm must-gather
```

## OCP3 更新其他元件憑證

* Service Catalog
* Metrics Server
* Hawkular Metrics
* Logging


https://access.redhat.com/solutions/4082831


---

CYG - notes

prod的
RD7 AIO:  rd7-ocp4-prod-must.tar 
PID抄單 : ocp3-pid-tls.txt
PID IPL : pid-ocp4-etcd-must-prod.tar

QA的
PID抄單：pid-ocp3-qa-must.txt
RD7 AIO: rd7-ocp4-qa-must.tar
PID IPL : pid-ocp4-qa-must.tar

