Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add instructions to readme for certificate rollover #15

Merged
merged 2 commits into from
May 17, 2022
Merged

Add instructions to readme for certificate rollover #15

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
de25210
Add instructions to readme for certificate rollover
mattkim May 17, 2022
38bede9
pr updates
mattkim May 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,22 @@ tcld namespace update accepted-client-ca set -n <namespace> --ca-certificate-fil
```
> :warning: If the update removes a certificate, any clients (tctl/workers) still using the removed certificate will fail to connect to the namespace after the update completes.

#### Performing a certificate rollover:
It is important to do a rollover process when updating your CA certificates. This allows your namespace to serve both CA certificates for a period of time until traffic to your old certificate is gone. To do this follow these steps:
1. Create a single file that contains both your old and new CA certificate PEM blocks. You can do this by simply concatenating each PEM block on a new line.
```
-----BEGIN CERTIFICATE-----
... old CA cert ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... new CA cert ...
-----END CERTIFICATE-----
```
2. Run the `update accepted-client-ca set` command with the new CA certificate bundle file.
3. Monitor traffic to your old certificate until it is gone.
4. Create a new CA certificate bundle file with the old certificate removed.
5. Run the `update accepted-client-ca set` command again with the new file.

### Add new search attributes:
```
tcld namespace update search-attributes add -n <namespace> --sa "<attribute-name>=<search-attribute-type>" --sa "<attribute-name>=<search-attribute-type>"
Expand Down