Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reload tls_client_ca_file on SIGHUP #39

Open
user404d opened this issue Jun 10, 2021 · 5 comments
Open

Reload tls_client_ca_file on SIGHUP #39

user404d opened this issue Jun 10, 2021 · 5 comments
Assignees
Labels
enhancement New feature or request

Comments

@user404d
Copy link

Is your feature request related to a problem? Please describe.
Reloading a TCP listener configuration will reload the included tls_cert_file and tls_key_file, but not the tls_client_ca_file.

Describe the solution you'd like
Upon reloading a TCP listener's configuration, reload the tls_client_ca_file if it is configured and enabled.

Describe alternatives you've considered
Restarting vault is an option, but it is convenient to replace certificate pieces while vault is running and allow vault to reload while still serving traffic.

Explain any additional use-cases

Additional context

@vishalnayak vishalnayak added the bug Something isn't working label Jun 22, 2021
@mahalrs
Copy link

mahalrs commented Jun 29, 2021

@vishalnayak I will work on this

/assign @mahalrs

@mahalrs
Copy link

mahalrs commented Jun 29, 2021

@vishalnayak I think we need to update TLSConfig() to use Listener.TLSClientCAFile, which means we also need to update NewCertificateGetter() and Reload() to use the TLSClientCAFile. Also, should we just ignore if tls_ca_file is not configured (meaning Listener.TLSClientCAFile is empty). Let me know if I missed anything.

@heatherezell
Copy link

@mahalrs were you able to get any progress made on this? Is there anything you need help with, or questions we can answer for you? Let us know if you're blocked.

@heatherezell
Copy link

Hi folks, it's been a while since we've heard from you regarding this issue. I'm going to go ahead and close it now, but please feel free to re-open if you need. Thanks for your understanding!

@user404d
Copy link
Author

This isn't something mission critical for me, but I don't know why this issue was closed. Is it intentional that this part of the tls config is not reloaded along with the rest?

@HridoyRoy HridoyRoy reopened this Jan 20, 2022
@HridoyRoy HridoyRoy self-assigned this Jan 20, 2022
@HridoyRoy HridoyRoy added enhancement New feature or request and removed bug Something isn't working labels Jan 20, 2022
@HridoyRoy HridoyRoy removed their assignment Apr 25, 2022
@kitography kitography transferred this issue from hashicorp/vault Apr 26, 2022
@kitography kitography self-assigned this Apr 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

6 participants