From 5a44c7552d3f8c7697de5a7d97a8d83213dcc159 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Dec 04 2025 16:11:37 +0000
Subject: update bugzilla2fedmsg sop with info on getting new cert


Signed-off-by: Kevin Fenzi <kevin@scrye.com>

---

diff --git a/modules/sysadmin_guide/pages/bugzilla2fedmsg.adoc b/modules/sysadmin_guide/pages/bugzilla2fedmsg.adoc
index ee72a81..68659f0 100644
--- a/modules/sysadmin_guide/pages/bugzilla2fedmsg.adoc
+++ b/modules/sysadmin_guide/pages/bugzilla2fedmsg.adoc
@@ -10,7 +10,7 @@ Source code: https://github.com/fedora-infra/bugzilla2fedmsg
 Owner::
   Messaging SIG, Fedora Infrastructure Team
 Contact::
-  #fedora-apps, #fedora-fedmsg, #fedora-admin, #fedora-noc
+  #fedora-apps, #fedora-admin, #fedora-noc
 Servers::
   STG/PROD Openshift Clusters
 Purpose::
@@ -64,3 +64,20 @@ oc rollout start bugzilla2fedmsg
 == Internal Contacts
 
 If we need to contact someone from the RH internal "unified messagebus" team, search for "unified messagebus" in source.
+
+== Getting new cert
+
+The service authenticates to the bus via a ssl cert. They usually last for a year,
+then need to be reissued/refreshed.
+
+The way to do this is: 
+
+1. generate a certificate signing request and key:
+openssl req -verbose -nodes -newkey rsa:4096 -out msg-client-fedora-prod.csr -subj "/UID=fedorainfra/OU=serviceaccounts/O=rhds/"
+
+2. Using the login/password in bitwarden (ask a sysadmin-main member)
+login and submit the csr and get the signed cert back
+
+3. check these into ansible-private under files/bugzilla2fedmsg/
+
+4. run the playbook and start a new build of the container.