Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-7345

External CA support - Support of CRL or OCSP

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • cert-manager
    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request
        Cert-manager: External CA support - Support of CRL or OCSP 
      2. What is the nature and description of the request?

      Cert manager does not perform revocation checks (e.g., via CRL or OCSP) on certificates it manages.
         - If the certificate is revoked by the Certificate Authority (CA):
               - Cert-Manager will not automatically realize that the certificate is revoked.
               - The revoked certificate remains in use unless the application or external processes detect and handle it.
      Certificate Rotation by Cert-Manager:
          Cert-Manager will not automatically issue a replacement unless:  
              - The certificate is nearing expiration.
              - The application or user manually deletes the revoked certificate, forcing Cert-Manager to request a new one.

            3. Why does the customer need this? (List the business requirements here)

      If a certificate is revoked, (customer provided certificate) it shall notify customer and trigger automation to delete the invalid certificate resource in OCP, prompting Cert-Manager to issue a new one.

      4. List any affected packages or components.

              rh-ee-npng Nick Png
              jnunez@redhat.com Jose Nuñez
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                None
                None