How to renew SSL certificate - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

How to Renew SSL Certificate in OCI Load Balancer

Overview

SSL/TLS Certificates are used to secure communication between users and applications over HTTPS. Certificates have an expiry date and must be renewed before expiration to avoid browser security warnings and service interruptions.

In a production environment, the client or security team typically provides the renewed certificate files. The OCI Administrator uploads the new certificate and associates it with the HTTPS Listener of the Load Balancer.

Why SSL Certificate Renewal is Required

SSL certificates have a limited validity period.

Common Validity Periods

  • 90 Days (Let's Encrypt)
  • 1 Year (Most Commercial Certificates)

If a certificate expires:

  • Users may receive browser security warnings.
  • HTTPS trust is broken.
  • Application access may be impacted.
  • Compliance and security requirements may be violated.

Therefore, certificate expiry monitoring and timely renewal are important operational activities.

Files Typically Provided by the Client

Before certificate expiration, the client usually shares the following files:

1. certificate.crt

The renewed SSL certificate issued by the Certificate Authority (CA).

Contains:

  • Domain Name
  • Validity Period
  • Public Key
  • Certificate Authority Information

Example:

www.company.com
api.company.com

2. private.key

The private key associated with the SSL certificate.

Purpose:

  • Used during SSL/TLS handshake.
  • Enables encrypted communication.
  • Must be kept secure and confidential.

3. ca_bundle.crt

Certificate chain containing intermediate CA certificates.

Purpose:

  • Establishes trust between the website certificate and the trusted root CA.
  • Prevents certificate chain validation errors.

Certificate Chain:

Server Certificate
       ↓
Intermediate CA
       ↓
Root CA

SSL Certificate Renewal Process in OCI

Step 1 – Receive Renewed Certificate Files

Obtain the following files from the client or security team:

certificate.crt
private.key
ca_bundle.crt

Verify:

  • Domain Name
  • Expiry Date
  • Certificate Details

Step 2 – Backup Existing Certificate

Before making changes:

  • Document current certificate details.
  • Record certificate expiry date.
  • Keep rollback information available.

Step 3 – Import Certificate into OCI

Navigate to:

OCI Console
→ Identity & Security
→ Certificates
→ Import Certificate

Upload:

  • certificate.crt
  • private.key
  • ca_bundle.crt

Provide a certificate name.

Example:

Production_SSL_2026

Click:

Create Certificate

Step 4 – Update Load Balancer HTTPS Listener

Navigate to:

Networking
→ Load Balancers
→ Select Load Balancer
→ Listeners

Open the HTTPS Listener:

Protocol: HTTPS
Port: 443

Edit Listener.

Select the newly imported certificate.

Save changes.

Step 5 – Validate HTTPS Connectivity

Verify:

  • Application is accessible.
  • HTTPS is functioning correctly.
  • No browser certificate warnings appear.
  • New expiry date is visible.

Browser Validation

Lock Icon
→ Certificate Details
→ Verify Expiry Date

Command Line Validation

curl -v https://application-url

Real-World Workflow

Client Provides Renewed Certificate
                ↓
Certificate Validation
                ↓
Import Certificate into OCI
                ↓
Update HTTPS Listener
                ↓
Validate Application Access
                ↓
Verify New Expiry Date
                ↓
Close Change Request

Best Practices

  • Renew certificates before expiration.
  • Always maintain rollback information.
  • Validate certificate details before deployment.
  • Verify certificate chain is complete.
  • Test HTTPS connectivity after implementation.
  • Monitor certificate expiration dates proactively.

Interview Questions and Answers

Q1. Have you worked on SSL certificate renewal?

Answer:

Yes. I have worked on SSL certificate renewal activities for applications behind OCI Load Balancers. The client provided the renewed certificate, private key, and CA bundle. I imported the certificate into OCI, updated the HTTPS Listener configuration, and validated HTTPS connectivity after deployment.

Q2. What files are required during SSL certificate renewal?

Answer:

The client typically provides:

  • certificate.crt
  • private.key
  • ca_bundle.crt

These files are uploaded into OCI and associated with the HTTPS Listener.

Q3. Why is the private key required?

Answer:

The private key is used during the SSL/TLS handshake process and enables secure encrypted communication between the client and server.

Q4. What is a CA Bundle?

Answer:

A CA Bundle contains intermediate certificate chain information that helps establish trust between the server certificate and the trusted root certificate authority.

Q5. What happens if an SSL certificate expires?

Answer:

Users may receive browser security warnings, HTTPS trust may fail, and application access can be impacted. Therefore certificates should be renewed before expiration.

Q6. Where do you update SSL certificates in OCI?

Answer:

Certificates can be imported through OCI Certificates Service and then associated with the HTTPS Listener configured on the OCI Load Balancer.

Interview Tip

Did you generate the SSL certificate yourself?

Answer:

Normally, SSL certificates are generated and renewed by the client's security team or the Certificate Authority (CA). My responsibility as an OCI Administrator was to import the renewed certificate into OCI, update the HTTPS Listener configuration on the Load Balancer, perform validation testing, and verify that the application was working correctly with the new certificate after deployment.