TLS Certificates for XCC

Below you’ll find commands to replace the TLS certificates for XCC.

Creating a a certificateIf you don’t have a certificate yet, create one by following your internal documentation or guides from Switch or DigiCert. You can also refer to OpenSSL documentation. The rest of the guide assumes you have the right files resulting from that already.

Obtain your signed certificate by your usual means and place the <private_key>.key and <certificate>.crt files to /etc/xorlab/tls, then execute:

cd /etc/xorlab/tls
openssl x509 -in <certificate>.crt -text
sudo cp ssl.crt ssl.crt.xor
sudo cp ssl.key ssl.key.xor
sudo chmod 400 <private_key>.key
sudo chmod 644 <certificate>.crt
sudo rm ssl.crt ssl.key
sudo ln -s <certificate>.crt ssl.crt
sudo ln -s <private_key>.key ssl.key
cd /etc/xorlab/xcc/
docker stop xcc_web && sleep 2 && docker compose up -d && docker compose logs -f --tail=1 web

Verify the certificate using openssl c_client:

openssl s_client -showcerts -servername <xcc_url> -connect <xcc_url>:443 </dev/null

⌘I