Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1683281

Summary:	Hosts cert reenrolment in upgrade should be executed sooner than certs are expired
Product:	[oVirt] ovirt-engine	Reporter:	Petr Matyáš <pmatyas>
Component:	Host-Deploy	Assignee:	Ori Liel <oliel>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Petr Matyáš <pmatyas>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	4.3.0	CC:	bugs, lleistne, mperina, tnisan
Target Milestone:	ovirt-4.3.4	Flags:	pm-rhel: ovirt-4.3+ lleistne: testing_ack+
Target Release:	4.3.4
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-engine-4.3.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-11 06:24:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Infra	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1649285
Bug Blocks:

Description Petr Matyáš 2019-02-26 13:59:18 UTC

Description of problem:
Now that we have certificate reenrolment in upgrade it would be much more useful to have it executed like a month before expiration and not when the cert is already expired.
There already is a notification for engine certificate expiration month before and engine certs are suggested to be reenrolled during engine setup month before expiration.

With current implementation when host certificate expires, the host is marked as unassigned and it is not possible (without changes to DB) to upgrade/reenroll certificates so if this would be executed during upgrade sooner it might mitigate some issues.

Version-Release number of selected component (if applicable):
ovirt-engine-4.3.1.2-0.0.master.20190225111554.git314f81b.el7.noarch

Comment 1 Martin Perina 2019-03-05 13:43:45 UTC

We could use "-attime timestamp" parameter of "openssl verify" and set it to current timestamp + ConfigValue.CertExpirationAlertPeriodInDays, (by default 7 days), meaning that if certification will expire in 7 or less days, we will renew it

Comment 2 Petr Matyáš 2019-05-22 10:38:17 UTC

Verified on ovirt-engine-4.3.4-0.1.el7.noarch

Comment 3 Sandro Bonazzola 2019-06-11 06:24:01 UTC

This bugzilla is included in oVirt 4.3.4 release, published on June 11th 2019.

Since the problem described in this bug report should be
resolved in oVirt 4.3.4 release, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.