[HDDS-8592] Fetch and save all root certificates during service's certificate rotation

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Component/s: Security
• Labels: pki pull-request-available
• Assignee: Szabolcs Gál
• Reporter: Szabolcs Gál
• Created: 11/May/23 12:43
• Updated: 06/Jul/23 15:58
• Resolved: 06/Jul/23 15:58

Description

There are a few steps needed before the final piece of root CA rotation can be fully implemented on client side.
DefaultCertificateClient needs the CertificateLifeTime monitor to be updated to be able to run when root ca rotation is scheduled not just when regular certificate rotation is in progress.
SignAndStoreCertificate currently is scattered across 3-4 different places, whereas a central location would fully suffice, and it also needs to be updated to use the new protocol to get the root CAs from the SCM.

Issue Links

• links to: GitHub Pull Request #5000
• links to: GitHub Pull Request #5000
• links to: GitHub Pull Request #5025