We wanted to reach out proactively and ensure that you are aware and fully prepared for a VERY IMPORTANT change on Amazon side.
As you may know, Amazon is replacing SSL certificates with AWS Certificate Manager (ACM) issued certificates on all Redshift clusters and will be effective on October 23, 2017.
NOTE: Customers that use Redshift Snaps that DO NOT utilize a “Redshift SSL Enabled Instance” will not be affected by this change and no action is required.
More information about ACM can be found at:
- Transitioning to ACM certificates for SSL connections - Amazon Redshift
- Managed renewal for ACM certificates - AWS Certificate Manager
- Configuring security options for connections - Amazon Redshift
This change will affect all SnapLogic customers using Redshift snaps with a “Redshift SSL Enabled Instance”. In order to comply with Amazon’s ACM requirements and not disrupt any SnapLogic pipelines, customers using Redshift snaps with a “Redshift SSL Enabled Instance” should immediately follow the appropriate steps below by Sunday October 22, 2017.
Groundplex, Linux Environment:
Update each node in the Groundplex where Redshift pipelines are run by using the following commands:
- sudo su snapuser
- export SL_ROOT=/opt/snaplogic
- wget https://s3.amazonaws.com/redshift-downloads/redshift-ca-bundle.crt
- $SL_ROOT/pkgs/jre1.8.0_45/bin/keytool -import -alias redshift -file redshift-ca-bundle.crt -keystore $SL_ROOT/pkgs/jre1.8.0_45/lib/security/cacerts -storepass changeit —noprompt
NOTE: The Java installation folder may not be under $SL_ROOT nor jre1.8.0_45. This may need to be modified based on the installation location of the Java Runtime Environment being used by the Snaplex.
After all nodes are updated, complete the following steps:
- Login to SnapLogic as an Org admin user
- Navigate to the Dashboard tab
- Select the Snaplex that contains the nodes you updated above
- Click on the down arrow for each node and select Restart
Groundplex, Windows Environment:
Update each node in the Groundplex where Redshift pipelines are run by using the following commands:
- Download the certificate from the following link: https://s3.amazonaws.com/redshift-downloads/redshift-ca-bundle.crt
- Execute the following command If JAVA_HOME is the location of the JRE:
%JAVA_HOME%\bin\keytool.exe -import -alias redshift -file redshift-ca-bundle.crt -keystore %JAVA_HOME%\lib\security\cacerts -storepass changeit --noprompt
After all nodes are updated, complete the following steps:
- Login to SnapLogic as an Org admin user
- Navigate to the Dashboard tab
- Select the Snaplex that contains the nodes you updated above
- Click on the down arrow for each node and select Restart
Cloudplex:
SnapLogic has updated the ACM certificates on all the UAT and Production based Cloudplex nodes (managed by SnapLogic).
Please follow the steps below by October 22nd 10AM Pacific:
- Login to SnapLogic as an Org admin user
- Navigate to the Dashboard tab
- Select the Snaplex that contains the nodes that run Redshift pipelines
- Click on the down arrow for each node and select Restart
Additional Q&A:
Once nodes are rebooted in the Cloudplex, are customers required to update with the new driver? Or will the old driver work?
Old drivers will work, so customers don’t have to update with the new driver.
We apologize for this inconvenience and encourage you to contact SnapLogic Support if you have any issues with the above. We will also be around to answer any questions or concerns you may have.
Thank you.
