Hide Forgot
Description of problem: Now that we have certificate reenrolment in upgrade it would be much more useful to have it executed like a month before expiration and not when the cert is already expired. There already is a notification for engine certificate expiration month before and engine certs are suggested to be reenrolled during engine setup month before expiration. With current implementation when host certificate expires, the host is marked as unassigned and it is not possible (without changes to DB) to upgrade/reenroll certificates so if this would be executed during upgrade sooner it might mitigate some issues. Version-Release number of selected component (if applicable): ovirt-engine-4.3.1.2-0.0.master.20190225111554.git314f81b.el7.noarch
We could use "-attime timestamp" parameter of "openssl verify" and set it to current timestamp + ConfigValue.CertExpirationAlertPeriodInDays, (by default 7 days), meaning that if certification will expire in 7 or less days, we will renew it
Verified on ovirt-engine-4.3.4-0.1.el7.noarch
This bugzilla is included in oVirt 4.3.4 release, published on June 11th 2019. Since the problem described in this bug report should be resolved in oVirt 4.3.4 release, it has been closed with a resolution of CURRENT RELEASE. If the solution does not work for you, please open a new bug report.