1. Proposed title of this feature request Increase default CA lifetime (advanced installation) 3. What is the nature and description of the request? The etcd and OpenShift internal CAs currently expire after 1 and 5 years respectively. This is extremely short for CAs for a product which is expected to up upgraded over time rather than replaced. When CAs expire all certificates need to be replaced and the new CA must be distributed to all hosts and trusted. When a signed certificate expires you only need to update it server side. 4. Why does the customer need this? Reduce the risk and impact of downtime from expired certificates. 5. How would the customer like to achieve this? - Increased default expiry - Configurable setting 6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented. - Rerun "config" playbooks with setting to replace all the certificates 7. Is there already an existing RFE upstream or in Red Hat Bugzilla? https://github.com/openshift/openshift-ansible/pull/2703 8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)? Before the current certificates expire... (9 months) 9. Is the sales team involved in this request and do they have any additional input? No 10. List any affected packages or components. openshift-ansible 11. Would the customer be able to assist in testing this functionality if implemented? Yes
ETCD CA 5yr lifespan in https://github.com/openshift/openshift-ansible/pull/2725
Install an ocp-3.3 env with openshift-ansible-3.3.46-1.git.0.2558730.el7.noarch.rpm, check all the cert files under /etc/etcd/ directory, all the certs have 5 year lifetime now. ca.crt Validity Not Before: Nov 8 07:32:42 2016 GMT Not After : Nov 7 07:32:42 2021 GMT Subject: CN=etcd-signer@1478590271 peer.crt Validity Not Before: Nov 8 07:33:00 2016 GMT Not After : Nov 7 07:33:00 2021 GMT Subject: CN=master-registry-etcd-1 server.crt Validity Not Before: Nov 8 07:32:57 2016 GMT Not After : Nov 7 07:32:57 2021 GMT Subject: CN=master-registry-etcd-1
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2016:2778