[HDDS-7453] Check certificate expiration at service startup, renew if necessary

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 1.3.0
• Component/s: Security
• Labels: pki pull-request-available
• Target Version/s: 1.3.0
• Assignee: István Fajth
• Reporter: István Fajth
• Created: 02/Nov/22 12:03
• Updated: 23/Jul/23 23:34
• Resolved: 09/Nov/22 03:34

Description

At service startup there is a possibility to ease the problem with the expiring internal SSL certificates.
The idea here is to check the expiration date of the certificate during initialization, and remove the key and certificate material if the certificate is expired or is about to expire, then recreate and re-initialize the certificate client of the service, with that as there won't be certificate material there, it would re-create the keys and file a CSR to the SCM, and get a new certificate.

Issue Links

• blocks: HDDS-7084 Release Ozone 1.3.0
• relates to: HDDS-9066 Remove the renew logic added by HDDS-7453
• links to: GitHub Pull Request #3930