etcd-certs：certificate has expired or is not yet valid

[hjzhu]

Hi,all.
I'm deploying diego alongside an existing CF deployment.When I use the etcd-certs in the template,it has a error below:

2017/08/16 10:59:28 Get https://database-z1-0.etcd.service.cf.internal:4001/v2/stats/self: x509: certificate has expired or is not yet valid

I want generate the etcd certs,but I don't find the script for generating the etcd certs.Is there any available certs or scripts?
Thanks a lot!

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/150291911

The labels on this github issue will be updated when the story is started.

[jvshahid]

@hjzhu can you answer the following questions:

1. which version of diego-release are you using ?
2. when you say CF deployment are you referring to https://github.com/cloudfoundry/cf-release/ or https://github.com/cloudfoundry/cf-deployment ? i am guessing the former but want to make sure

[emalm]

Hi, @hjzhu,

The etcd BOSH release has a generate-certs script that may be useful for generating these TLS credentials.

Modern versions of Diego (since v1.2.0) must use a SQL database for their persistent storage instead of etcd. We strongly recommend you switch to that persistence option. Additionally, the cf-deployment manifests automatically apply that SQL-backed configuration and generate TLS credentials via the v2 BOSH CLI, and we recommend its use instead of the manifest-generation systems in cf-release and diego-release for development environments.

Best,
Eric