Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1391548

Summary: Increase default CA lifetime (advanced installation)(https://github.com/openshift/openshift-ansible/pull/2703)
Product: OpenShift Container Platform Reporter: Miheer Salunke <misalunk>
Component: InstallerAssignee: Andrew Butcher <abutcher>
Status: CLOSED ERRATA QA Contact: Gaoyun Pei <gpei>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.3.0CC: aos-bugs, gpei, jliggitt, jokerman, mmccomas
Target Milestone: ---   
Target Release: 3.3.1   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Previously the etcd certificate authority created by the installer had an expiry date one year in the future. This has been updated to five years matching the lifespan of other certificate authorities created by the installer.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-15 19:10:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Miheer Salunke 2016-11-03 14:14:54 UTC 
1. Proposed title of this feature request

Increase default CA lifetime (advanced installation)



3. What is the nature and description of the request?
The etcd and OpenShift internal CAs currently expire after 1 and 5 years respectively.  This is extremely short for CAs for a product which is expected to up upgraded over time rather than replaced.  When CAs expire all certificates need to be replaced and the new CA must be distributed to all hosts and trusted.  When a signed certificate expires you only need to update it server side.

4. Why does the customer need this?
Reduce the risk and impact of downtime from expired certificates.

5. How would the customer like to achieve this?
- Increased default expiry
- Configurable setting

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.
- Rerun "config" playbooks with setting to replace all the certificates

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?
https://github.com/openshift/openshift-ansible/pull/2703

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?
Before the current certificates expire... (9 months)

9. Is the sales team involved in this request and do they have any additional input?
No

10. List any affected packages or components. 
openshift-ansible

11. Would the customer be able to assist in testing this functionality if implemented?
Yes
Comment 5 Scott Dodson 2016-11-04 15:20:25 UTC 
ETCD CA 5yr lifespan in https://github.com/openshift/openshift-ansible/pull/2725
Comment 8 Gaoyun Pei 2016-11-08 08:59:44 UTC 
Install an ocp-3.3 env with openshift-ansible-3.3.46-1.git.0.2558730.el7.noarch.rpm, check all the cert files under /etc/etcd/ directory, all the certs have 5 year lifetime now.

ca.crt
        Validity
            Not Before: Nov  8 07:32:42 2016 GMT
            Not After : Nov  7 07:32:42 2021 GMT
        Subject: CN=etcd-signer@1478590271
peer.crt
        Validity
            Not Before: Nov  8 07:33:00 2016 GMT
            Not After : Nov  7 07:33:00 2021 GMT
        Subject: CN=master-registry-etcd-1
server.crt
        Validity
            Not Before: Nov  8 07:32:57 2016 GMT
            Not After : Nov  7 07:32:57 2021 GMT
        Subject: CN=master-registry-etcd-1
Comment 9 errata-xmlrpc 2016-11-15 19:10:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2016:2778