Machine ID: Document the 24 hour maximum certificate TTL #44894
Labels
Comments
timothyb89
added a commit
that referenced
this issue
Aug 1, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
github-merge-queue bot
pushed a commit
that referenced
this issue
Aug 1, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
github-actions bot
pushed a commit
that referenced
this issue
Aug 1, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
github-actions bot
pushed a commit
that referenced
this issue
Aug 1, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
github-merge-queue bot
pushed a commit
that referenced
this issue
Aug 2, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
github-merge-queue bot
pushed a commit
that referenced
this issue
Aug 2, 2024
This adds some notes to the Machine ID docs explaining that a TTL limit exists, and an explanation in the FAQ explaining why. It also adds a logged warning on bot startup if the TTL request exceeds the server limit. Fixes #44894
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Applies To
Details
Machine ID has a hard-coded server-side 24 hour limit to the
certificate_ttlconfig parameter. This is defined for security purposes, to encourage the use of short lived and renewable certificates. The limit can be surprising to users, however, and I was not able to find any public-facing discussion of why we set it in the docs.How will we know this is resolved?
The limit should be made clear on the reference documentation, and an FAQ entry may be appropriate as this does come up occasionally. A mention of the limit in the Architecture page may also be worthwhile.
Related Issues
The text was updated successfully, but these errors were encountered: