Renewing oVirt Certificates Before They Expire

Introduction¶

oVirt runs its own internal certificate authority. The CA and the certificates it issues (engine HTTPS, engine↔VDSM, VDSM, libvirt, websocket proxy, etc.) all expire. Renewing before expiry is a calm, planned task. Renewing after is a recovery operation.

Certificate lifetimes¶

• Internal CA: historically ~10 years (older deployments), newer ~ shorter.
• Leaf certificates (engine, hosts): typically ~398 days / 5 years depending on version — always verify, don't assume.

Both the CA and the leaves matter. If the CA is close to expiry you must renew the CA first (a bigger operation), then re-enroll everything.

Check what expires when¶

# On the engine — the key certs
for f in /etc/pki/ovirt-engine/certs/*.cer /etc/pki/ovirt-engine/ca.pem; do
  echo "== $f"
  openssl x509 -in "$f" -noout -subject -enddate
done

# The Apache cert the browser sees
openssl x509 -in /etc/pki/ovirt-engine/certs/apache.cer -noout -enddate

# On each host
openssl x509 -in /etc/pki/vdsm/certs/vdsmcert.pem -noout -subject -enddate
openssl x509 -in /etc/pki/libvirt/clientcert.pem -noout -enddate

Newer oVirt exposes expiry in the UI and raises an audit-log warning ~30 days out. There's also:

ovirt-engine-check-pki-expire        # if present in your version

Put a calendar reminder ~60 days before the earliest expiry.

Renewing host certificates (rolling, no VM downtime)¶

Per host, one at a time:

1. In the Admin Portal: Compute → Hosts → (host) → Management → Maintenance. VMs live-migrate off.
2. Management → Enroll Certificate. The engine re-issues the VDSM/libvirt certs from the current CA.
3. Management → Activate. VMs can migrate back.
4. Repeat for the next host.

Because you drain each host first, running VMs are never interrupted.

Renewing the engine certificate¶

The supported path is engine-setup, which detects near-expiry certs and offers to renew:

# On the engine host — schedule a short maintenance window
engine-setup --offline

# When prompted:
#   "Renew certificates?  (Yes)"
#   (newer versions ask specifically about the PKI / Apache cert)

engine-setup stops the engine, re-issues the internal certs (and the Apache cert), updates trust stores, and restarts. Downtime is the engine restart only — a few minutes — during which running VMs are unaffected (the engine isn't in the data path); you just can't manage or migrate.

For the Apache/HTTPS cert specifically, if you use a custom (public CA) certificate for the web UI, follow the "replacing the Apache SSL certificate" procedure for your version instead — engine-setup manages the internal one.

After renewal — verify¶

# Engine
openssl x509 -in /etc/pki/ovirt-engine/certs/apache.cer -noout -enddate
systemctl status ovirt-engine httpd ovirt-websocket-proxy

# From a host, confirm it still talks to the engine
vdsm-client Host getStats

# Hosts show "Up", no cert warnings in the audit log
tail -n 100 /var/log/ovirt-engine/engine.log | grep -i cert

Log into the web UI in a fresh browser session and confirm no TLS warning (for the internal cert you'll still get the "unknown CA" prompt unless you trust the oVirt CA — that's expected).

Verification and troubleshooting¶

• engine-setup doesn't offer renewal — the certs aren't close enough to expiry yet (it only prompts within a window), or your version needs engine-setup --reconfigure-optional-components / a version-specific flag. Check the release notes for your exact version.
• Host "Enroll Certificate" greyed out — the host isn't in Maintenance.
• After host enroll, host goes Non Operational — time skew between engine and host (fix chrony), or the host didn't pick up the new CA. Re-run enroll, or reinstall the host (Installation → Reinstall) which redoes PKI.
• Websocket console (noVNC/SPICE) breaks after renewal — the ovirt-websocket-proxy cert wasn't renewed / the service wasn't restarted. systemctl restart ovirt-websocket-proxy.
• CA itself is near expiry — this is a larger, version-specific procedure (pki-enroll-request.sh / documented CA renewal). Do it well ahead; don't let a CA expire.
• Custom Apache cert reverted to self-signed — engine-setup can overwrite it; re-apply your custom cert via the documented procedure and keep the config in 20-setup-ovirt-post.conf style answer files.

Related tools and reading¶

• On-site: SSL Certificate Checker, Certificate decoder.
• Related posts: oVirt engine certificate renewal after expiry, oVirt architecture overview.