Query regarding upgrading Concourse NAT certificates


On our Concourse setup, Bosh generated NAT certs are expiring in next 2 months and we need to renew this. We are on Concourse 5.8.0.
We are on AWS and use Control-Tower to deploy and operate Concourse CI in production.

I wanted to get some more information in order to upgrade/renew the certificates. I found one reference "https://bosh.io/docs/nats-ca-rotation/ " but as different devops team used to support Concourse environment before so I am not much aware if I can follow approach mentioned in the link. Any inputs from Concourse experienced team members will be really appreciated as this tools is new to me and it’s the first time I will be renewing certificates here.

Thanks in advance.


Hi. I’m glad your finding Control Tower useful! I’m one of the maintainers of that tool.

We actually include a maintain command that will rotate the NATs certs for you.

1 Like

Hi ccrsimmons,

Thank you so much for the reply and your time.

I was looking at various options if use maintain command to rotate the certs but I have one query:

control-tower maintain has 1 required option and rest are optional ones. one of optional value is “stage” and as per documentation:
"Specify a specific stage at which to start the NATS certificate renewal process.
If not specified, the stage will be determined automatically.

So let’s say I don’t specify it and let “Control-Tower” to decide the stage automatically. Is it ok?

So if I use:

control-tower maintain --renew-nats-cert --iaas AWS --namespace <my-namespace-for-deployment>

will it be ok?

Thanks again.

Yeah that should work (although don’t forget to put the name of your deployment at the end of the command as well).

We follow the cert rotation instructions on bosh.io from your first post. The optional stage param is for forcing the process to start at a specific step from those docs. If you don’t provide that param Control Tower will start from the first step and if it fails it will save the stage it got to into the bucket. Then it will start from there on the next run.

1 Like

Thanks a ton Crsimmons.