[HDDS-9015] Block CSR request in SCM for "hdds.x509.rootca.certificate.polling.interval" time period

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Labels: pull-request-available
• Assignee: Sammi Chen
• Reporter: Sammi Chen
• Created: 14/Jul/23 03:55
• Updated: 09/Aug/23 12:37
• Resolved: 04/Aug/23 22:36

Description

Once the root CA rotation and sub CA rotation finished, leader SCM will start to serve CSR request from other services, like existing OM, DN, Recon, or newly added OM, DN and SCM.

But the problem is every service's certificate is signed without coordination, so that there will be some services whose certificates are already signed by new Root CA, and some services whose certificates are still old certificates and the cert renew not happened yet, then these services cannot talk to each other because some already got the new certificate and new root CA certificate, but some are not.

Blocking the CSR for a "hdds.x509.rootca.certificate.polling.interval" period of time will guarantee that all services get the root CA certificate during this duration, so the above cannot talk to each case can be avoided.

Issue Links

• fixes: HDDS-9016 Failed to Read data from previously created key
• links to: GitHub Pull Request #5064