go/common/identity: Save re-generated sentry client and node's persistent TLS certificate #4382
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kostko
reviewed
Dec 1, 2021
tjanez
force-pushed
the
tjanez/sentry-client-cert-save
branch
2 times, most recently
from
1dad914 to
ca993a4
Compare
tjanez
changed the title
tjanez
requested review from
Yawning,
peterjgilbert,
pro-wh and
ptrus
as code owners
Codecov Report
@@ Coverage Diff @@
## master #4382 +/- ##
==========================================
- Coverage 67.15% 67.07% -0.09%
==========================================
Files 430 430
Lines 48655 48653 -2
==========================================
- Hits 32675 32632 -43
- Misses 11961 11991 +30
- Partials 4019 4030 +11
Continue to review full report at Codecov.
|
kostko
approved these changes
Mar 31, 2022
Sentry client TLS certificate is always re-generated from the private key when the Oasis Node starts. Previously, the re-generated sentry client TLS certificate was not saved to disk, which caused confusion since the on-disk certificate file (i.e. sentry_client_tls_identity_cert.pem) had incorrect/outdated expiry date.
If a node's TLS certificate is persistent, it is always re-generated from the private key when the Oasis Node starts. Previously, the re-generated node's persistent TLS certificate was not saved to disk, which caused confusion since the on-disk certificate file (i.e. tls_identity_cert.pem) had incorrect/outdated expiry date.
tjanez
force-pushed
the
tjanez/sentry-client-cert-save
branch
from
ca993a4 to
86460bf
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Sentry client TLS certificate is always re-generated from the private key when the Oasis Node starts.
Previously, the re-generated sentry client TLS certificate was not saved to disk, which caused confusion since the on-disk certificate file (i.e.
sentry_client_tls_identity_cert.pem) had incorrect/outdated expiry date.Also, save re-generated node's persistent TLS certificate. If a node's TLS certificate is persistent, it is always re-generated from the private key when the Oasis Node starts.
Previously, the re-generated node's persistent TLS certificate was not saved to disk, which caused confusion since the on-disk certificate file (i.e.
tls_identity_cert.pem) had incorrect/outdated expiry date.