Renewal of custom domain certificate using the Custom Domain Manager app

[WouterLemaire]

Introduction

As I used certbot to sign my custom domain certificate it is only valid for 3 months and I need to renew it.

Last time, I used the CF CLI plugin for custom domains because CLI is just cool but also because I didn’t know if the custom domain manager application is free or costs extra. Nevertheless, I wanted to use the custom domain manager application for the renewal of the certificate to compare it with the CLI.

Preparation: Activate the custom domain manager application

First, make sure you have the entitlements in your subaccount for this:

Now, you should be able to subscribe to the Custom Domain Service with plan standard in your subaccount:

Once subscribed, your subaccount contains new roles. Assign the Custom Domain Administrator role to your user:

With the authorizations you can start the application. Go to "instances and subscriptions" to find the Custom Domain Manager in the list of subscriptions. Select the line and you’ll see the button “Go to Application”. This button will bring you to Custom Domain Manager application:

Renew certificate – Try 1

My expectation was that I would be able to simply renew the certificate in the earlier created private key. Unfortunately, I didn’t find any button in the screen of the private key to do so, no option to request a new CSR, no update certificate,... .

Renew certificate – Try 2

This brought me back to the CF CLI where I tried the command to get a new CSR:

This one clearly stated that the CSR is not available anymore.

Renew certificate – Try 3

So I tried to use the previous retrieved CSR again (which I stored on my computer) to send it to certbot for signing:

Once signed, I tried to upload it to the same private key which resulted in the following error.

Renew certificate – Final try

When looking for SAP notes about the previous error message I found the following SAP note:

https://me.sap.com/notes/3233828

This says it is not possible to use the same key for updating the certificate with a reference to the documentation: https://help.sap.com/docs/custom-domain/custom-domain-service/update-certificate

This means we need to create a new key every time we renew the certificate and delete the previous one afterwards:

With this new information, I went back to the “Custom Domain Service Manager” application:

In the app I navigate to the tab “Server Certificates” followed by “ Create Server Certificate for your Custom Domains”:

This starts a wizard where I provided the following information:

• Alias: a name that contains the month and year for the certificate
• Key Size: I kept the default “3072”

Select the landscape to apply the custom domain on:

I also used the opportunity to use “*.lemaire.tech” as main domain. This allows me to use wouter.lemaire .tech but also other subdomains for “lemaire.tech” without always to have “wouter” in it😊 . So I selected the following two:

All the details for the subject:

Once the wizard is finished I was able to download the CSR:

This opens a dialog with the certificate which you have to copy into a .pem file:

This CSR (.pem) file can be used to sign it with certbot using the following command. The steps are the same as the first time when using CF CLI. The command to sign it with certbot:

certbot certonly --manual --csr ./csr.pem --preferred-challenges dns

During this process I had to apply the following config in the custom domain configuration of google domains:

Once saved it looks like this, it still contains the previous acme record in my config:

This generated again a certificat chain that can be uploaded to BTP in the Custom Domain Manager:

In the Custom Domain Manager app I had to paste the certificate from the file. Certbot provided me 3 files but only the last one is needed:

Validate the certificate and click on next step:

The last step is just for confirmation, just click on Finish:

This will result in two certificates, one that will expire soon and one which is inactive (the one you just created):

Activate the new Certificate

Click on the newly created private key and click on “Activate”:

This opens a new wizard where you need to select the Subject Alternative Names which you would like to activate. I only selected “*.lemaire.tech” because I want to use it for other subdomains but not the “lemaire.tech” domain itself.

I just continued with the default TLS configuration:

Validate the summary and confirm!

Final step, configure the domain in your custom domain manager (I use google domains for this):

Cleanup

Once the new certificate is active, you can delete the previous one. Navigate to the previous certificate and click on delete:

After cleaning up, you should have one left:

Result

I have my personal website running using this domain: https://wouter.lemaire.tech

Next to that, I also used to domain to make an easy to remember url for the BTP Service overview matrix application: https://btp-services.lemaire.tech

 My conclusion, the Custom Domain Manager application works great and makes a lot of the steps easier to execute. Nevertheless, using the CF CLI helps to better understand all the steps you need to execute. In the end, the application executes the CF CLI commands through an API with a UI on top of it which makes it more user friendly 😉