Bug 1748378

Summary:	public signed certificate required to replace default router certificates
Product:	OpenShift Container Platform	Reporter:	Eric Rich <erich>
Component:	Documentation	Assignee:	Andrew Taylor <antaylor>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Hongan Li <hongli>
Severity:	high	Docs Contact:	Vikram Goyal <vigoyal>
Priority:	urgent
Version:	4.1.0	CC:	antaylor, aos-bugs, jokerman, scuppett, wsun
Target Milestone:	---
Target Release:	4.2.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-09-03 20:11:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Eric Rich 2019-09-03 13:27:41 UTC

Document URL: https://docs.openshift.com/container-platform/4.1/networking/ingress-operator.html#nw-ingress-setting-a-custom-default-certificate_configuring-ingress

Section Number and Name: Setting a custom default certificate

Describe the issue: https://bugzilla.redhat.com/show_bug.cgi?id=1712525

Suggestions for improvement: Place a note/warning on the docs that states "if replacing the default cert, it must be signed by a public CA already included in the ca bundle, as provided by RHEL/RHCOS".

Additional information:

Comment 2 Eric Rich 2019-09-03 15:04:08 UTC

Minor nit: as provided by RHEL/RHCOS should really say as provided by the RHEL 7/8 UBI userspace. 
They are fundamentally one and the same as RHEL/RHCOS userspace, but what's important to denote here is that these certificates are not part of the host; but part of the container used in our deployment. Making the CA's unique to the container; and not something you can globally configure *(using system resources).

Comment 5 Andrew Taylor 2019-09-03 15:30:16 UTC

Pull request here:
https://github.com/openshift/openshift-docs/pull/16476

Will merge and cherrypick to 4.1 and 4.2 ASAP. Setting release pending.

Comment 6 Andrew Taylor 2019-09-03 20:11:19 UTC

Changes are now live: 

https://docs.openshift.com/container-platform/4.1/networking/ingress-operator.html#nw-ingress-setting-a-custom-default-certificate_configuring-ingress

Closing this bug as current release.