Page MenuHomePhabricator

Expose not-yet-live certs to clients so they can handle OCSP stapling
Closed, ResolvedPublic

Description

Related to T204997: certcentral: delay deployment of renewed certs to wait out skewed client clocks

<bblack> while we're on the certcentral stuff in general, another longer-term thing we'll have to eventually solve, related to the waiting-for-clock-skew period and such:
<bblack> is handling client-side integration of OCSP stapling reliably.  Which is going to mean shipping the client multiple certs when going through a renewal.
<bblack> (the old solution doesn't do any of this of course)
<bblack> the idea is that for OCSP stapling to work reliably, the client-https-service has to have the cert ahead of time, to run a local OCSP fetch and populate.
<bblack> so you can imagine a hypothetical model like:
<bblack> CC manages it more like a "set" of overlapping certs: the old one it's renewing well ahead of time, and the new renewal it has just-recently fetched from LE (but is perhaps not "live" yet, because we're waiting a day for clock skew before deployment)
<bblack> it could ship the whole set to the client (multiple files), and an indicator as to which is live
<bblack> so the old one would still be "live" initially while we wait clock skew, but having the new one sent over lets the client start prefetching OCSP data for it, so that later when it becomes live the OCSP is ready to go.
<bblack> there's probably like 10 ways to factor that out, and ? about how much of the state is managed client-side or CC-side

Details

Related Gerrit Patches:
operations/puppet : productionacme_chief: Clean old file based certificate files (2/2)
operations/puppet : productionacme_chief: Clean old file based certificate files (1/2)
operations/puppet : productionicinga: Switch to the directory based deployment used by acme-chief
operations/puppet : productiongerrit: Switch to the directory based deployment used by acme-chief
operations/puppet : productionexim: Switch to the directory based deployment used by acme-chief
operations/puppet : productionmirrors: Switch to the directory based deployment used by acme-chief
operations/puppet : productionlists: Switch to the directory based deployment used by acme-chief
operations/puppet : productionopenldap: Switch to the directory based deployment used by acme-chief
operations/puppet : productiondumps: Switch to the directory based deployment used by acme-chief
operations/puppet : productionarchiva: Switch to the directory based deployment used by acme-chief
operations/puppet : productioninstall: Switch to the directory based deployment used by acme-chief
operations/puppet : productiontendril: Switch to the directory based deployment used by acme-chief
operations/puppet : productionnetbox: Switch to the directory based deployment used by acme-chief
operations/puppet : productionlibrenms: Switch to the directory based deployment used by acme-chief
operations/puppet : productionacme_chief: Update acme_chief::cert resource to fetch several cert versions
operations/software/acme-chief : debiandebian: Add release 0.13 to changelog
operations/software/acme-chief : debianRelease 0.13
operations/software/acme-chief : masterRelease 0.13
operations/software/acme-chief : debianacme-chief-api: Add support for puppet HTTP API search operation
operations/software/acme-chief : masteracme-chief-api: Add support for puppet HTTP API search operation
operations/software/acme-chief : masteracme-chief-api: Add support for puppet HTTP API search operation
operations/puppet : productionacme_chief: Fix cert-sync.conf
operations/puppet : productionacme-chief: Update certs-sync to mirror the new directory tree
operations/software/acme-chief : debiandebian: Add release 0.11 to changelog
operations/software/acme-chief : debiandebian: Replace live_certs and new_certs with certs
operations/software/acme-chief : debianRelease 0.11
operations/software/acme-chief : debianacme-chief: Store certificates in unique directories
operations/software/acme-chief : masterRelease 0.11
operations/software/acme-chief : masteracme-chief: Store certificates in unique directories

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change 495854 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme-chief: Update certs-sync to mirror the new directory tree

https://gerrit.wikimedia.org/r/495854

Change 496148 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Update acme_chief::cert resource to fetch several cert versions

https://gerrit.wikimedia.org/r/496148

Change 494956 merged by jenkins-bot:
[operations/software/acme-chief@master] acme-chief: Store certificates in unique directories

https://gerrit.wikimedia.org/r/494956

Change 496753 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/acme-chief@master] Release 0.11

https://gerrit.wikimedia.org/r/496753

Change 496753 merged by jenkins-bot:
[operations/software/acme-chief@master] Release 0.11

https://gerrit.wikimedia.org/r/496753

Change 496754 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/acme-chief@debian] acme-chief: Store certificates in unique directories

https://gerrit.wikimedia.org/r/496754

Change 496755 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/acme-chief@debian] Release 0.11

https://gerrit.wikimedia.org/r/496755

Change 496756 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/acme-chief@debian] debian: Replace live_certs and new_certs with certs

https://gerrit.wikimedia.org/r/496756

Change 496757 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/software/acme-chief@debian] debian: Add release 0.11 to changelog

https://gerrit.wikimedia.org/r/496757

Change 496754 merged by jenkins-bot:
[operations/software/acme-chief@debian] acme-chief: Store certificates in unique directories

https://gerrit.wikimedia.org/r/496754

Change 496755 merged by jenkins-bot:
[operations/software/acme-chief@debian] Release 0.11

https://gerrit.wikimedia.org/r/496755

Change 496756 merged by jenkins-bot:
[operations/software/acme-chief@debian] debian: Replace live_certs and new_certs with certs

https://gerrit.wikimedia.org/r/496756

Change 496757 merged by jenkins-bot:
[operations/software/acme-chief@debian] debian: Add release 0.11 to changelog

https://gerrit.wikimedia.org/r/496757

Mentioned in SAL (#wikimedia-operations) [2019-03-18T08:58:14Z] <vgutierrez> uploaded acme-chief 0.11 to apt.wikimedia.org (buster) - T207295

Change 495854 merged by Vgutierrez:
[operations/puppet@production] acme-chief: Update certs-sync to mirror the new directory tree

https://gerrit.wikimedia.org/r/495854

Change 497251 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Fix cert-sync.conf

https://gerrit.wikimedia.org/r/497251

Change 497251 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Fix cert-sync.conf

https://gerrit.wikimedia.org/r/497251

Change 494506 abandoned by Vgutierrez:
acme-chief-api: Add support for puppet HTTP API search operation

Reason:
Discarded in favor of I286e5b65ec574ea38336a31aeab52599558d5c84 and Ib8a40a049486bc0e4a861041e56d1451c8ecef71

https://gerrit.wikimedia.org/r/494506

Change 497440 had a related patch set uploaded (by Alex Monk; owner: Vgutierrez):
[operations/software/acme-chief@debian] acme-chief-api: Add support for puppet HTTP API search operation

https://gerrit.wikimedia.org/r/497440

Change 494957 merged by jenkins-bot:
[operations/software/acme-chief@master] acme-chief-api: Add support for puppet HTTP API search operation

https://gerrit.wikimedia.org/r/494957

Change 497444 had a related patch set uploaded (by Alex Monk; owner: Alex Monk):
[operations/software/acme-chief@master] Release 0.12

https://gerrit.wikimedia.org/r/497444

Change 497444 had a related patch set uploaded (by Alex Monk; owner: Alex Monk):
[operations/software/acme-chief@master] Release 0.13

https://gerrit.wikimedia.org/r/497444

Change 497440 had a related patch set uploaded (by Alex Monk; owner: Vgutierrez):
[operations/software/acme-chief@debian] acme-chief-api: Add support for puppet HTTP API search operation

https://gerrit.wikimedia.org/r/497440

Change 497440 merged by jenkins-bot:
[operations/software/acme-chief@debian] acme-chief-api: Add support for puppet HTTP API search operation

https://gerrit.wikimedia.org/r/497440

Change 497444 merged by Vgutierrez:
[operations/software/acme-chief@master] Release 0.13

https://gerrit.wikimedia.org/r/497444

Change 497527 had a related patch set uploaded (by Alex Monk; owner: Alex Monk):
[operations/software/acme-chief@debian] Release 0.13

https://gerrit.wikimedia.org/r/497527

Change 497527 merged by jenkins-bot:
[operations/software/acme-chief@debian] Release 0.13

https://gerrit.wikimedia.org/r/497527

Change 497532 had a related patch set uploaded (by Alex Monk; owner: Alex Monk):
[operations/software/acme-chief@debian] debian: Add release 0.13 to changelog

https://gerrit.wikimedia.org/r/497532

Change 497532 merged by jenkins-bot:
[operations/software/acme-chief@debian] debian: Add release 0.13 to changelog

https://gerrit.wikimedia.org/r/497532

Change 496148 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Update acme_chief::cert resource to fetch several cert versions

https://gerrit.wikimedia.org/r/496148

Mentioned in SAL (#wikimedia-operations) [2019-03-21T08:01:35Z] <vgutierrez> deploying directory based certificates in acme-chief clients - T207295

Change 496148 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Update acme_chief::cert resource to fetch several cert versions

https://gerrit.wikimedia.org/r/496148

Change 498109 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] librenms: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498109

Change 498109 merged by Vgutierrez:
[operations/puppet@production] librenms: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498109

Change 498336 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] netbox: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498336

Change 498336 merged by Vgutierrez:
[operations/puppet@production] netbox: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498336

Change 498339 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] tendril: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498339

Change 498339 merged by Vgutierrez:
[operations/puppet@production] tendril: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498339

Change 498342 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] install: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498342

Change 498342 merged by Vgutierrez:
[operations/puppet@production] install: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498342

Change 498771 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] archiva: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498771

Change 498771 merged by Vgutierrez:
[operations/puppet@production] archiva: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498771

Change 498774 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] dumps: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498774

Change 498774 merged by Vgutierrez:
[operations/puppet@production] dumps: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498774

Change 498776 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] openldap: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498776

Change 498776 merged by Vgutierrez:
[operations/puppet@production] openldap: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498776

Change 498781 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] lists: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498781

Change 498781 merged by Vgutierrez:
[operations/puppet@production] lists: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498781

Change 498811 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] mirrors: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498811

Change 498811 merged by Vgutierrez:
[operations/puppet@production] mirrors: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498811

Change 498892 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] exim: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498892

Change 498892 merged by Vgutierrez:
[operations/puppet@production] exim: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498892

Change 498900 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] gerrit: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498900

Change 498900 merged by Vgutierrez:
[operations/puppet@production] gerrit: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498900

Change 498904 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] icinga: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498904

Change 498904 merged by Vgutierrez:
[operations/puppet@production] icinga: Switch to the directory based deployment used by acme-chief

https://gerrit.wikimedia.org/r/498904

Change 498920 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Clean old file based certificate files (1/2)

https://gerrit.wikimedia.org/r/498920

Change 498921 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Clean old file based certificate files (2/2)

https://gerrit.wikimedia.org/r/498921

Mentioned in SAL (#wikimedia-operations) [2019-03-27T08:33:02Z] <vgutierrez> disabling puppet in acme-chief clients to get rid safely of old TLS material - T207295

Change 498920 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Clean old file based certificate files (1/2)

https://gerrit.wikimedia.org/r/498920

Mentioned in SAL (#wikimedia-operations) [2019-03-27T09:06:50Z] <vgutierrez> puppet reenabled in acme-chief clients - T207295

Change 498921 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Clean old file based certificate files (2/2)

https://gerrit.wikimedia.org/r/498921

Vgutierrez closed this task as Resolved.Mar 27 2019, 9:19 AM
Vgutierrez removed a project: Patch-For-Review.