Renew SSL certificate

An expired SSL certificate on the server affects the management of enrolled devices. It is therefore important to renew the SSL certificate before it expires to ensure smooth operation and continued control over enrolled devices.

The procedure differs depending on the installation, the reverse proxy and the origin of the certificate.

Guide by installation #

A purchased certificate is prepared as described in Renew a purchased certificate → before it is put in place.

The Compose file in the /opt/relution directory (compose.yaml, in older installations docker-compose.yml) shows which reverse proxy is in use: it contains either a traefik: or an nginx: block.

Certificate files #

If a new key pair was generated for the new certificate, the server.key file is additionally replaced with the new private key in every variant. If the existing private key was reused (e.g. the same CSR, or a new CSR created with the existing key), server.key remains unchanged. The server.pem file contains the server certificate including the intermediate certificates; if the new certificate is available as a PFX file, it is converted first, see Convert certificate to PEM →.

Additional notes #

If the SSL certificate is also used as the signing certificate for Apple devices (see Configure iOS signing certificate →), the files are also replaced at the location configured there (Docker/Linux: under /opt/relution, Windows: in the installation directory, or at the given path when prefixed with file:). Relution only reads the signing certificate at startup; a restart of Relution is therefore required after the replacement.

If the signing certificate is passed via the environment variable KEYSTORE_IOS_SIGNER_PEM, its content is updated instead with the new private key and certificate in PEM format. Since docker compose restart does not apply changed environment variables, the container is then recreated with docker compose up -d.