docs: DOC-1224 Self-Hosted Custom CA Update (#3061) (#3133)

* docs: DOC-1224

* docs: vertex steps

* docs: updated instructions

* Apply suggestions from code review

(cherry picked from commit f775c3c)

Co-authored-by: Karl Cardenas <[email protected]>

docs/docs-content/enterprise-version/install-palette/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md

@@ -237,23 +237,42 @@ The default container runtime for OVAs is [Podman](https://podman.io/), not Dock
     ```
 
 19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud
-    Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. The custom
-    certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
-
-    - **server.crt**
-    - **server.key**
+    Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM.
 
     If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for
     you.
 
     :::warning
 
-    The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different format,
-    convert them to base64 PEM format before copying them to the support VM. The airgap setup process also expects the
-    files to be named **server.crt** and **server.key**.
+    Three items you need to keep in mind when providing custom SSL certificates:
+
+    - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different
+      format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also
+      expects the certificate files to be named **server.crt** and **server.key**.
+
+    - The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for
+      the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch.
+
+    - The custom SSL certificates files must have the following permissions bits set:
+
+      - **server.crt**: 644
+      - **server.key**: 600
 
     :::
 
+    The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
+
+    - **server.crt**
+    - **server.key**
+
+    You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor
+    during the airgap setup process and must have access to the custom SSL certificates. Use the following command to
+    ensure the permissions are set correctly.
+
+    ```shell
+    chown -R 10000:10000 /data/secret/cert/*
+    ```
+
 20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
     address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will
     generate a self-signed certificate for the value you provide.

docs/docs-content/vertex/install-palette-vertex/install-on-vmware/airgap-install/vmware-vsphere-airgap-instructions.md

@@ -238,23 +238,42 @@ If you are working in Vim, press `i` to enter insert mode in the text editor. Pr
     ```
 
 19. If you have custom SSL certificates you want to apply to the image and pack registry, and the Spectro Cloud
-    Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM. The custom
-    certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
-
-    - **server.crt**
-    - **server.key**
+    Repository, copy the custom SSL certificates, in base64 PEM format, to the airgap support VM.
 
     If you do not provide a custom SSL certificate, the airgap setup process will generate a self-signed certificate for
     you.
 
     :::warning
 
-    The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different format,
-    convert them to base64 PEM format before copying them to the support VM. The airgap setup process also expects the
-    files to be named **server.crt** and **server.key**.
+    Three items you need to keep in mind when providing custom SSL certificates:
+
+    - The custom SSL certificates must be in base64 PEM format. If you have custom SSL certificates in a different
+      format, convert them to base64 PEM format before copying them to the support VM. The airgap setup process also
+      expects the certificate files to be named **server.crt** and **server.key**.
+
+    - The custom certificate's Fully Qualified Domain Name (FQDN) must match the hostname or IP address you provide for
+      the airgap support VM. Otherwise, the airgap setup process will fail due to a certificate mismatch.
+
+    - The custom SSL certificates files must have the following permissions bits set:
+
+      - **server.crt**: 644
+      - **server.key**: 600
 
     :::
 
+    The custom certificates must be placed in the **/opt/spectro/ssl** folder. Include the following files:
+
+    - **server.crt**
+    - **server.key**
+
+    You also need to update the permissions for the **/data/secret/cert/** directory. This folder is mounted to Harbor
+    during the airgap setup process and must have access to the custom SSL certificates. Use the following command to
+    ensure the permissions are set correctly.
+
+    ```shell
+    chown -R 10000:10000 /data/secret/cert/*
+    ```
+
 20. Start the airgap initialization process by issuing the following command. The script requires the hostname or IP
     address of the airgap support VM. Choose the preferred method for your environment. Be aware that the script will
     generate a self-signed certificate for the value you provide.