Bug 1688184

I think best place would be the engine showing a warning when PKI is near to expire.

Engine is periodically (each day by default) checking of following certificates [1]:

1. Engine CA
2. Engine
3. Hosts which are Up or NonOperational

When any of those certificates are going to be expired we emit following messages into audit_log:

1. If certificate will expire in less than 30 days, we raise WARNING message into audit log
2. If certificate will expire in less than 7 days, we raise ALERT message into audit log
3. If certificate is expired, we raise ALERT message into audit log

We cannot do much about hosts which engine cannot communicate with, because hosts certificates are not stored on engine, but I see only 2 usecases here:

1. Hosts are temporarily unavailable (for example Installing, Connecting, NonResponsive, Kdumping, Reboot, ...), so they should be checked during next day(s)
2. Maintenance - administrators should be aware of hosts in maintenance (especially those which are going to stay in Maintenance for longer than 30 days), so they can execute Enroll Certificate to hosts in maintenance before activating them


So is there anything important missing?


[1] https://github.com/oVirt/ovirt-engine/blob/master/backend/manager/modules/bll/src/main/java/org/ovirt/engine/core/bll/CertificationValidityChecker.java#L65

(In reply to Martin Perina from comment #2)
> Engine is periodically (each day by default) checking of following
> certificates [1]:
> 
> 1. Engine CA
> 2. Engine
> 3. Hosts which are Up or NonOperational
> 
> When any of those certificates are going to be expired we emit following
> messages into audit_log:
> 
> 1. If certificate will expire in less than 30 days, we raise WARNING message
> into audit log
> 2. If certificate will expire in less than 7 days, we raise ALERT message
> into audit log
> 3. If certificate is expired, we raise ALERT message into audit log

All of this seems reasonable, and I'd close notabug, other than one thing.
engine-setup notifies and prompts under somewhat different conditions:
1. It checks more certs, and prompts if at least one requires action. These are: CA, engine, jboss (used for direct https access to it), websocket-proxy, apache, imageio-proxy.
2. It prompts if it expires in the next 365 days (much more than 30)
3. It prompts if it has no SAN (SubjectAlternativeName) extension (bug 1449084)
4. It prompts if the expires-not-before timestamp has no timezone (bug 1210486)

What do you think? Should we unify the tests? Not sure we must, but it might make sense. At least deciding on a single number of days is very easy (code-wise, not sure about docs/process) and makes sense...

The actual code testing this is in the file packaging/setup/plugins/ovirt-engine-setup/ovirt-engine/pki/ca.py , in the functions _expired and _ok_to_renew_cert .

This bug didn't get any attention for a while, we didn't have the capacity to make any progress. If you deeply care about it or want to work on it please assign/target accordingly

This bug didn't get any attention for a while, we didn't have the capacity to make any progress. If you deeply care about it or want to work on it please assign/target accordingly

ok, closing. Please reopen if still relevant/you want to work on it.

ok, closing. Please reopen if still relevant/you want to work on it.