[HDDS-7401] Cover the PKI system with docker based integration tests

• Type: Improvement
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Component/s: Security
• Labels: pki
• Assignee: István Fajth
• Reporter: István Fajth
• Created: 24/Oct/22 13:33
• Updated: 29/Aug/23 17:47

Description

We should cover the new PKI system with integration tests properly.

The following scenarios we should surely include, but additional ones might be defined later as we go:

• regular security bootstrap
• certificate rotation before expiration
• rootCA certificate rotation before expiration
• rootCA certificate revocation
• subordinate CA certificate revocation
• revocation of all subordinate CA certs that are signed by the rootCA
• revocation of a single certificate

Issue Links

• blocks: HDDS-7331 Ozone PKI improvements

Sub-Tasks

• Create tests that cover certificate hotswap mechanisms: Resolved
• Test the change from old to new trust chain encoding approach: Open