Skip to content

docs: update certificate rotation warning #1782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 23, 2025
Merged

docs: update certificate rotation warning #1782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions doc/source/configuration/openbao.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,10 +110,9 @@ Setup OpenBao HA on the overcloud hosts
Rotating OpenBao certificate on the overcloud hosts
---------------------------------------------------

The certificate for the overcloud OpenBao has an expiry time of one year. While
the cloud won't break if this expires, it will need rotating before new
certificates can be generated for internal PKI. If a OpenBao becomes sealed, it
cannot be unsealed with an expired certificate.
The certificate for the overcloud OpenBao has an expiration of one or two years after the certificate was generated.
The expiration date of a certificate can be determined with ``openssl x509 -enddate -noout -in overcloud.crt``
This will be problematic if anything needs to interact with the OpenBao API such as issuing new certificates or Barbican integration.

1. Delete the old certificate:

Expand Down
7 changes: 3 additions & 4 deletions doc/source/configuration/vault.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,10 +117,9 @@ Setup Vault HA on the overcloud hosts
Rotating Vault certificate on the overcloud hosts
-------------------------------------------------

The certificate for the overcloud vaults has an expiry time of one year. While
the cloud won't break if this expires, it will need rotating before new
certificates can be generated for internal PKI. If a vault becomes sealed, it
cannot be unsealed with an expired certificate.
The certificate for the overcloud Vault has an expiration of one or two years after the certificate was generated.
The expiration date of a certificate can be determined with ``openssl x509 -enddate -noout -in overcloud.crt``
This will be problematic if anything needs to interact with the Vault API such as issuing new certificates or Barbican integration.

1. Delete the old certificate:

Expand Down
Loading