Egeria shipped self-signed certificates will expire soon

[planetf1]

Our egeria self-signed certificates will expire shortly (see #6326 from 2022)

➜  certificates git:(main) ls
EgeriaClient.cert.pem        EgeriaReactUIClient.cert.pem EgeriaReactUIServer.csr.pem  EgeriaServerChassis.cert.pem EgeriaUIChassis.csr.pem      openssl.cnf
EgeriaClient.csr.pem         EgeriaReactUIClient.csr.pem  EgeriaReactUIServer.key.pem  EgeriaServerChassis.csr.pem  EgeriaUIChassis.key.pem
EgeriaClient.key.pem         EgeriaReactUIClient.key.pem  EgeriaReactUIServer.p12      EgeriaServerChassis.key.pem  EgeriaUIChassis.p12
EgeriaClient.p12             EgeriaReactUIClient.p12      EgeriaRootCA                 EgeriaServerChassis.p12      README.md
EgeriaIntermediateCA         EgeriaReactUIServer.cert.pem EgeriaRootCA.p12             EgeriaUIChassis.cert.pem     gensamplecerts.sh
➜  certificates git:(main) find . -name '*.cert.pem' -exec openssl x509 -enddate -noout -in {} \;
notAfter=Mar 26 11:25:19 2023 GMT
notAfter=Mar 26 11:25:18 2023 GMT
notAfter=Mar 26 11:25:19 2023 GMT
notAfter=Mar 26 11:25:18 2023 GMT
notAfter=Mar 13 11:25:17 2032 GMT
notAfter=Mar 13 11:25:18 2032 GMT
notAfter=Mar 26 11:25:19 2023 GMT

Short term actions

• Alert dev team
• update certs in main (v4)
• Identify/update certs in additional components
  • React UI (/ssl) @davidradl
  • egeria charts
  • business UI @sarbull
  • where else?
• Assess impact on users of 3.15
  • Local build
  • Local running of chassis
  • Helm charts
• External communication

Longer term actions

• [BUG] Update certs for ui chassis #6351
• Remove certificates from / require deployment of certs for all Egeria source projects #6990

[planetf1]

Our self-signed CA will remain valid until 2032. However individual certificates for various components will expire on Mar 26.

The impact of this will vary. In many cases in test environments, certificate validity is not checked, so egeria will continue to work. In production environment propert certs should be used, so again no impact

Last year we saw FVTs failing, as they were configured correctly to validate certs ..

[planetf1]

New certs pushed in PR:

 certificates git:(issue7503) find . -name '*.cert.pem' -exec openssl x509 -enddate -noout -in {} \;
notAfter=Mar 18 12:30:49 2024 GMT
notAfter=Mar 18 12:30:48 2024 GMT
notAfter=Mar 18 12:30:48 2024 GMT
notAfter=Mar 18 12:30:48 2024 GMT
notAfter=Mar 13 11:25:17 2032 GMT
notAfter=Mar 13 11:25:18 2032 GMT
notAfter=Mar 18 12:30:49 2024 GMT

[planetf1]

• helm charts only contain truststore - unmodified

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 20 days if no further activity occurs. Thank you for your contributions.

[planetf1]

This will need some action, and incorporation into the process or they will expire again.

[mandy-chessell]

I think this is complete

[planetf1]

Although self-signed certs are a little looser coupled into the tree now, they're still used & in demos.
At a minimum (and perhaps this is done) I'd recommend updating the certs as part of the release cycle