connect: connect CA Roots in the primary datacenter should use a SigningKeyID derived from their local intermediate #9428
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rboyer
added
type/bug
github-actions
bot
removed
the
theme/connect
|
This needs to be backported to 1.9, 1.8, and 1.7. The 1.7 backport will need to be manual. |
freddygv
reviewed
Jan 4, 2021
rboyer
force-pushed
the
primary-leaf-churn-vault
branch
from
75e0ee4 to
6a4035c
Compare
|
@rboyer is there any chance that we can include this fix in the upcoming release? |
rboyer
force-pushed
the
primary-leaf-churn-vault
branch
from
9434d0e to
1f4f4bc
Compare
kyhavlov
approved these changes
Jan 27, 2021
…ingKeyID derived from their local intermediate This fixes an issue where leaf certificates issued in primary datacenters using Vault as a Connect CA would be reissued very frequently (every ~20 seconds) because the logic meant to detect root rotation was errantly triggering. The hash of the rootCA was being compared against a hash of the intermediateCA and always failing. This doesn't apply to the Consul built-in CA provider because there is no intermediate in use in the primary DC. This is reminiscent of #6513.
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
This reverts commit 3b466d5.
rboyer
force-pushed
the
primary-leaf-churn-vault
branch
from
55cc4c0 to
89d8f85
Compare
|
🍒 If backport labels were added before merging, cherry-picking will start automatically. To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/324541. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes an issue where leaf certificates issued in primary
datacenters using Vault as a Connect CA would be reissued very
frequently (every ~20 seconds) because the logic meant to detect root
rotation was errantly triggering.
The hash of the rootCA was being compared against a hash of the
intermediateCA and always failing. This doesn't apply to the Consul
built-in CA provider because there is no intermediate in use in the
primary DC.
This is reminiscent of #6513.