Bug 1391548 - Increase default CA lifetime (advanced installation)(https://github.com/openshift/openshift-ansible/pull/2703)
Summary: Increase default CA lifetime (advanced installation)(https://github.com/opens...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.3.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 3.3.1
Assignee: Andrew Butcher
QA Contact: Gaoyun Pei
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-03 14:14 UTC by Miheer Salunke
Modified: 2016-11-15 19:10 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Previously the etcd certificate authority created by the installer had an expiry date one year in the future. This has been updated to five years matching the lifespan of other certificate authorities created by the installer.
Clone Of:
Environment:
Last Closed: 2016-11-15 19:10:58 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2778 0 normal SHIPPED_LIVE Moderate: atomic-openshift-utils security and bug fix update 2016-11-16 00:08:29 UTC

Description Miheer Salunke 2016-11-03 14:14:54 UTC
1. Proposed title of this feature request

Increase default CA lifetime (advanced installation)



3. What is the nature and description of the request?
The etcd and OpenShift internal CAs currently expire after 1 and 5 years respectively.  This is extremely short for CAs for a product which is expected to up upgraded over time rather than replaced.  When CAs expire all certificates need to be replaced and the new CA must be distributed to all hosts and trusted.  When a signed certificate expires you only need to update it server side.

4. Why does the customer need this?
Reduce the risk and impact of downtime from expired certificates.

5. How would the customer like to achieve this?
- Increased default expiry
- Configurable setting

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.
- Rerun "config" playbooks with setting to replace all the certificates

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?
https://github.com/openshift/openshift-ansible/pull/2703

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?
Before the current certificates expire... (9 months)

9. Is the sales team involved in this request and do they have any additional input?
No

10. List any affected packages or components. 
openshift-ansible

11. Would the customer be able to assist in testing this functionality if implemented?
Yes

Comment 5 Scott Dodson 2016-11-04 15:20:25 UTC
ETCD CA 5yr lifespan in https://github.com/openshift/openshift-ansible/pull/2725

Comment 8 Gaoyun Pei 2016-11-08 08:59:44 UTC
Install an ocp-3.3 env with openshift-ansible-3.3.46-1.git.0.2558730.el7.noarch.rpm, check all the cert files under /etc/etcd/ directory, all the certs have 5 year lifetime now.

ca.crt
        Validity
            Not Before: Nov  8 07:32:42 2016 GMT
            Not After : Nov  7 07:32:42 2021 GMT
        Subject: CN=etcd-signer@1478590271
peer.crt
        Validity
            Not Before: Nov  8 07:33:00 2016 GMT
            Not After : Nov  7 07:33:00 2021 GMT
        Subject: CN=master-registry-etcd-1
server.crt
        Validity
            Not Before: Nov  8 07:32:57 2016 GMT
            Not After : Nov  7 07:32:57 2021 GMT
        Subject: CN=master-registry-etcd-1

Comment 9 errata-xmlrpc 2016-11-15 19:10:58 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2016:2778


Note You need to log in before you can comment on or make changes to this bug.