Purpose

This article outlines the process for replacing an expiring SSL certificate used by the NGINX service within an Omnivex DataStack deployment on Windows.

DataStack requires access to both a certificate (.crt) file and its corresponding private key (.key) file. These files are referenced by the NGINX configuration and are used to secure HTTPS communications between clients and the DataStack services. Omnivex documentation states that customers must provide both the certificate and key files for proper configuration. 

Prerequisites

Before starting, ensure you have:

• A replacement SSL certificate (.crt).
• The corresponding private key (.key).
• Administrative access to the DataStack server.
• Access to the Omnivex installation directory.
• A maintenance window if required by local operational procedures.

Important:  If your Certificate Authority has provided a .PFX / .P12 file instead of separate .CRT and .KEY files, these files must be extracted before proceeding.  Refer to the OpenSSL documentation for guidance:

• OpenSSL PKCS#12 Documentation
• SSL.com PKCS#12 Export Guide

Step 1: Locate the Existing Certificate Files

On the DataStack server, navigate to:

    C:\Omnivex Ink\Certs

This directory contains the certificate and key files currently used by NGINX.

    Example:

          C:\Omnivex Ink\Certs\datastack.crt

          C:\Omnivex Ink\Certs\datastack.key

Step 2: Back Up Existing Files

Before making any changes, create a backup of the current certificate files, by copying them in the same directory. 

    Example:

        datastack.crt -> datastack.crt.bak

        datastack.key -> datastack.key.bak

It is also recommended to back up the NGINX configuration file before editing.

Step 3: Copy the New Certificate and Key

Copy the new certificate and key files into:

    C:\Omnivex Ink\Certs

    Example:

        C:\Omnivex Ink\Certs\NewCertificate.crt

        C:\Omnivex Ink\Certs\NewCertificate.key

Step 4: Update NGINX Configuration

Locate the NGINX configuration file:

    C:\Omnivex Ink\NGINX\conf\nginx.conf

Open the file in a text editor running as Administrator.

Locate the SSL configuration entries:

    Nginx Config

        ssl_certificate C:/Omnivex Ink/Certs/OldCertificate.crt;

        ssl_certificate_key C:/Omnivex Ink/Certs/OldCertificate.key;

Update the file references to the new certificate and key:

    Nginx Config

        ssl_certificate C:/Omnivex Ink/Certs/NewCertificate.crt;

        ssl_certificate_key C:/Omnivex Ink/Certs/NewCertificate.key;

Save the file.

Step 5: Restart the NGINX Service

After updating the configuration, restart the NGINX service to load the new certificate.

This can be performed through:

Windows Services

Open:

    services.msc

Locate:

    NGINX

Select:

    Restart

Alternatively, you can restart using an administrative command prompt:

    net stop nginx

    net start nginx

Step 6: Validate the Certificate

Open a browser and connect to the Data Stack URL.

Confirm:

• The site loads over HTTPS.
• No certificate warnings are displayed.
• The certificate expiry date matches the newly installed certificate.
• The certificate subject matches the expected DataStack FQDN.

Rollback Procedure

If issues are encountered after the certificate replacement:

1. Restore the previous .crt and .key files from backup.
2. Update nginx.conf to reference the original files.
3. Restart the NGINX service.
4. Verify connectivity has been restored.

Additional Information

The Omnivex DataStack architecture uses NGINX as the HTTPS entry point and TLS termination layer for DataStack services. NGINX listens on port 443 and uses the configured certificate and private key to secure incoming client connections.

For environments using load balancers or SSL passthrough, certificate management may be performed on the load balancer instead of directly on the DataStack server.  Refer to your organization's infrastructure standards for implementation details.