EFA Root CA

EFA is shipped with Root CA that is used to generate Intermediate CA. The Root CA is unique across each EFA and is generated during installation.

Location

TPVM: /apps/efadata/certs/ca/extreme-ca-root.pem
Server: /opt/efadata/certs/own/extreme-ca-root.pem

Expiry and Alerts

The EFA Root CA is valid till 20 years from the date of installation. It supports the following alerts which effects the health of EFA security subsystem:

CertificateExpiryNoticeAlert
CertificateExpiredAlert
CertificateUnreadableAlert

For more information, see Fault Management.

Renewal

To renew or regenerate the Root CA, run the renewal script efa_renew_certs.sh.

Note

In TPVM, the renewal script is available in /apps/efa/ and /opt/efa/ on a server installation.

sudo bash <path to the script>/efa_renew_certs.sh --type rootca

After the Root CA is updated,

New Intermediate CA is generated
New EFA Server Certificate is generated. If a third-party certificate is used, then the server certificate generation is skipped.

On renewal of certificate, CertificateRenewalAlert is raised which changes the health of the system to green.