SSL Certificate Renewal Process
Overview
SSL certificates on your SmartCare environment expire on a set schedule and must be renewed before they lapse. Renewal is a shared process between Streamline, CalMHSA, and your county. Streamline generates the certificate requests and applies the final certificates. Your county (or CalMHSA on your behalf) obtains the renewed certificates and sends them back.
All communication for a renewal happens through a single Zendesk ticket so everyone has one place to track status, dates, and files.
Who Does What
| Role | Responsibilities |
|---|---|
| Streamline PM / CSM / CXM | Creates and manages the Zendesk ticket, communicates with CalMHSA and the county, tracks key dates, and makes sure certificates are returned in time. |
| Streamline Cloud Operations | Tracks expiration dates, generates Certificate Signing Requests (CSRs), applies completed certificates to the servers, and confirms technical completion. |
| County / CalMHSA | Uses the CSRs to obtain renewed certificates and returns them through the Zendesk ticket. Validates access and functionality after each certificate is applied. |
Renewal Timeline
Renewals are planned backward from the expiration date:
- Expiration date: Identified by Streamline and the county.
- Planned application date: About 14 days before expiration.
- CSR generation date: About 14 days before the planned application date.
This gives roughly four weeks for the county to obtain certificates and for both sides to schedule and validate the work.
Example: If a certificate expires on February 9, the planned application date is January 25 and CSRs are generated on January 11.
Typical Certificates
Most environments have three certificates. Your environment may differ.
| Certificate | Applies To | Notes |
|---|---|---|
| Production database | Production database servers (including high-availability pairs) | May require planned downtime to apply. |
| Production report server | Production report servers | Separate from the database certificate. |
| Non-production shared | Non-production database and report servers | One certificate covers both. |
Step-by-Step Process
Step 1: Track upcoming expirations (Streamline and County)
Both sides keep track of expiration dates and start planning early enough to allow time for CSR generation, certificate processing, scheduling, and validation.
Step 2: Zendesk ticket is created (Streamline)
The Streamline PM, CSM, or CXM opens a Zendesk ticket for the renewal. All updates, files, and dates are tracked there.
Step 3: CSRs are generated (Streamline)
On the CSR generation date, Streamline creates one CSR for each certificate.
Step 4: CSRs are sent to the county (Streamline)
Streamline sends the CSRs through the Zendesk ticket with clear instructions on what the county needs to do and what Streamline needs back.
Step 5: County returns completed certificates (County / CalMHSA)
Use the CSRs to obtain renewed certificates and attach them to the Zendesk ticket. If you share a secure download link instead, Streamline will retrieve the files and confirm they match the CSRs.
Step 6: Non-production certificate is applied first (Streamline and County)
Streamline schedules and applies the non-production certificate. Your county validates that non-production access and functionality work as expected. Testing here first reduces risk before production changes.
Step 7: Production certificates are applied (Streamline and County)
After non-production is validated, Streamline schedules a production window. The production database certificate may require planned downtime. The report server certificate is coordinated the same way.
Step 8: Validation and closure (Streamline and County)
Streamline confirms the certificates are applied and working. Once your county confirms everything is functioning, the Zendesk ticket is closed.
What Your County Needs to Do
- Watch for the Zendesk ticket from Streamline and respond promptly.
- Return completed certificates before the planned application date.
- Be available to validate non-production after the first certificate is applied.
- Coordinate with Streamline on a production window, including any downtime.
- Confirm production is working so the ticket can be closed.