Bug 2079890 - renew certificates sooner before they expire
Summary: renew certificates sooner before they expire
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: General
Version: ---
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ovirt-4.5.0-1
: 4.5.0.7
Assignee: Milan Zamazal
QA Contact: Petr Kubica
URL:
Whiteboard:
Depends On:
Blocks: 2075352
TreeView+ depends on / blocked
 
Reported: 2022-04-28 12:47 UTC by Michal Skrivanek
Modified: 2022-05-30 06:42 UTC (History)
4 users (show)

Fixed In Version: ovirt-engine-4.5.0.7
Clone Of:
Environment:
Last Closed: 2022-05-30 06:42:37 UTC
oVirt Team: Infra
Embargoed:
pm-rhel: ovirt-4.5?
lsvaty: exception+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github oVirt ovirt-engine pull 324 0 None open Improve certificate renewal 2022-05-02 17:28:20 UTC
Github oVirt ovirt-engine pull 347 0 None open Backport CA and certificate fixes to 4.5.0.z 2022-05-09 13:40:24 UTC
Red Hat Issue Tracker RHV-45888 0 None None None 2022-04-28 17:15:33 UTC

Internal Links: 2078025

Description Michal Skrivanek 2022-04-28 12:47:26 UTC
IIUC we currently renew certificates that are due to expire
60 days in advance during engine-setup for engine certs and CA
30 days (vdc_option CertExpirationAlertPeriodInDays) for host certs (during Host Upgrade)

We can renew sooner than that (with bz# 2079835, bz# 2079799), a 365 days in advance, to make sure that we don't get into a situation that certificates expire when there are no host upgrades available. Since our current validity is 13 months this will make sure that practically all these certs are reissued the first time this changed code runs.

Comment 1 Petr Kubica 2022-05-25 20:55:20 UTC
engine-setup: (after 1 year when engine certificates are about to expire)
- One or more of the certificates should be renewed, because they expire soon, or include an invalid expiry date, or they were created with validity period longer than 398 days, or do not include the subjectAltName extension, which can cause them to be rejected by recent browsers and up to date hosts.

host-upgrade:
during enrolling certificates or host upgrade, relevant certificates were renewed
- new certificates have additional 5 years of validity.

Verified in ovirt-engine-4.5.0.7-0.9.el8ev.noarch


Note You need to log in before you can comment on or make changes to this bug.