TLS Certificate Renewal

[arun-kbharathan-e3768]

Hi,

I noticed in the code that the root CA is generated with a 10-year validity, while the leaf certificates are valid for only 1 year. What happens to the cluster if the leaf certificates are not updated after they expire? Will inter-node communication fail, leading to a full cluster failure?

As the certificate nears its expiry date, what is the recommended process for updating it? Is there any OpenSearch metric that indicates when a certificate is nearing expiration?

If we manually update the node certificates, will the operator automatically detect the change and perform a rolling restart?

[arshashi]

As a workaround, you can delete the below secrets manually and it will get regenerate by opensearch-operator in 4-5 mins. After that perform rollout restart of deployments, daemonsets and statefulset

Secrets:
opensearch-admin-cert
opensearch-http-cert
opensearch-transport-cert
opensearch-dashboard-cert

To check validity of the cert use the below command

1. extract the content of the cert and run the below
2. openssl x509 -in opensearch-admin.crt -text -noout

If there is any other way we can address this, please share the same.

[samof76]

Why not provide configuration to actually create the leaf cert to be set to 10 years as well? And add an annotation for expiry.