What happens with expired certificates?

[henningWoehr]

Hi,

I'm trying to find out, what happens, when a sealing key expires (normally after 365 days). I found some things on encrypting, that there will be an error and the user cant encrypt with that. I just can't seem to find anything about decrypting with an expired key. Is that still possible or is the sealed secret useless as soon as the encryption key is expired?

[mg1986jp]

When the sealing key expires (after the default 30 days rotation, not 365 — the 365 day thing is for the actual certificate validity), existing SealedSecrets that were encrypted with the old key will still be decryptable because the controller keeps all old private keys in its cluster secret.

The main things to know:

• Old SealedSecrets continue to work after key rotation — the controller stores all historical private keys
• New SealedSecrets must be encrypted with the current public cert. If you kubeseal --fetch-cert you always get the latest one
• If you delete the controller's secret (the sealed-secrets-key* secrets in the controller namespace), then you lose the ability to decrypt old SealedSecrets. That's the scenario you need to worry about
• Certificate "expiry" in sealed-secrets context mainly affects whether new sealing operations accept the cert, not whether old sealed values can be decrypted

So in practice, you just need to make sure you back up the controller's private keys and always seal with the current cert.