How to do rolling update of TLS certificates?

[bboreham]

Contemplating a certificate update, I am afraid that until all agents and servers have been restarted to read the new certificates, there may be errors caused by an old agent calling a new server or vice-versa.

If that is correct, I'd like to ask for documentation how to avoid such errors. E.g. can I configure both old and new certificates at each end?

If it is incorrect, I would ask for a note stating this will be fine in the docs on certificates.

[Joseph-Irving]

Hi, that somewhat depends on what you mean by a certificate update.
If you're just generating new Server/Agent certificates from the same root CA there shouldn't be any issues, the trust is at the CA level as long as they're still signed by that they should trust each other.
If you're changing the root CA then you will need to do a more careful switchover, create a new Server DS/Service using the new CA and Certs, and then update the Agent DS to use the new service (ensure you're using the onDelete update strategy here).

We had a breaking tls change between v2 and v3 and this guide covers the basic process
https://github.com/uswitch/kiam/blob/master/docs/UPGRADING.md

[bboreham]

I should have said: I am running version 3.4 and generated the certs following these instructions.

So if I understand correctly, using the same ca-key.pem (as long as it hasn't expired) and starting from step 2 will result in certificates that can be seamlessly updated?

If this is the right approach, I think the instructions should stress that ca-key.pem should be stored so it can be used a year later.

[andyyaldoo]

Hi @Joseph-Irving, if I'm using cert-manager to manage the certs (I followed the instruction here), do i have to worry about rotating the agents and/or server for the new certs to be picked up?

[avdhoot]

yes we faced similar issue.

[pingles]

Dynamic TLS was added in #366 so it should be possible to rotate without needing to restart processes. I'm going to close this for now. Thank you for mentioning though.