[HDDS-9111] Phase II - Automated live rotation of CA certificates

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Ozone Datanode, SCM
• Target Version/s: 2.0.0
• Assignee: István Fajth
• Reporter: Arpit Agarwal
• Created: 02/Aug/23 15:12
• Updated: 09/Aug/23 12:31

Description

Phase 2 tasks left over from HDDS-7391

Issue Links

• blocks: HDDS-7331 Ozone PKI improvements

Sub-Tasks

• Add API elements to update CA cert rotation time in SCMs: Open
• Implement the CLI to update rootCA certificate rotation time: Open
• Update rootCA rotation time in Ozone Manager: Open
• Distribute rootCA rotation time updates to DataNodes: Open
• Update rootCA rotation time in Recon: Open
• Recover public key and certificate with private key present for DN and Recon: Resolved
• Write Security audit entry to track activities related to Private Keys and certificates: Open
• Certificate Client recovery - keypair not found: Open
• Hold the rootCA's private key only in memory for the time of initialization/rotation, then forget it: In Progress
• IP address checks neglect disabling some IPv6 addresses that are disabled for IPv4: Open