[HDDS-7335] Certificate renewal and revocation related cleanup

• Type: Improvement
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Component/s: Security
• Labels: certificate_cleanup pki
• Assignee: István Fajth
• Reporter: István Fajth
• Created: 14/Oct/22 21:36
• Updated: 29/Aug/23 17:46

Description

• cleanup the code and remove old unnecessary CRL related logic
• cleanup the bootstrap code, and whatever left from refactoring during certificate renewal support
• implement cleanup of old expired/revoked certificates both on hosts and in the SCM DB

Issue Links

• blocks: HDDS-7331 Ozone PKI improvements

Sub-Tasks

• Implement a cleaner logic that removes old certs from the SCM DB: Resolved
• Fix package name typos in o.a.h.hdds.security.x509: Resolved
• Cleanup unused/unnecessary code from CertificateClient related code parts: Resolved
• Cleanup loadAllCertificates code in DefaultCertificateClient: Resolved
• Cleanup SecurityConfig and related class initialization: Resolved
• Remove expired certificates from SCM DB: Resolved
• Clean in memory certificates once they expired/renewed/revoked: Open
• Cleanup unnecessary logic from CertificateClients after symmetric key based tokens: Open
• Refactor component service on disk security materials directory structure: Open
• Create CertificateStore and separate its logic from CertificateClient: Open
• Remove unnecessary old CRL logic: Open
• SelfSignedCertifcate and CertificateSignRequests should have a common base class: Open
• SelfsignedCertificate's generateCertificate() method dead code: Open