Standardize certificate management on DS8 device

The DS8 currently uses two different methods to manage digital certificates:

1.  https server certificate (CSR generated and import of signed cert) 

2. Syslog secure forwarding certificate (import of private key and certificate components generated off-host). This is generally less secure method as it requires the user to manage the private key.

These two processes should be simplified to have the option to share a digital certificate as most enterprises use the same internal CA authority to sign and verify secure connections within their internal network. 

Suggestions:

1. APIs to manage certificates and support for all certificate formats.

2. Ansible modules to perform the same tasks.

3. Use a single keystore on DS8 to load certs into.

4. Allow HMC, https server and syslog configs to point to the same certificates on the keystore. 

This will standardise toe certificate management and usage for all DS8 secure functions and allow a simple automation pipeline to renew certificates without human intervention. For example:

Automation Pipeline (Ansible Playbook):

Task 1. Run weekly Ansible job to check DS8 server cert i.e. with simple openssl connect command to extract cert details. Or if IBM provide API to check cert expiry. Either will work.

Task 2. If cert is expiring within 30 days or less, then trigger API call to generate CSR on DS8.

Task 3. Send CSR to Company CA authority to sign.

Task 4. Import signed certificate to DS8 and configure services to use new certificate.

Task 5. Restart HMC if required.

Task 6. Check new certificate is valid i.e. serial number and expiry date (can be openssl connect command).

Task 7. Revoke old certificate in Company CA.