Venafi / Venafi/vcert

Provide the ability to reset the certificate object in Venafi TPP

Open
#239 7 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Go
Stars
106
Forks
77
Avg merge
6d 21h
Merged PRs (30d)
1

Description

BUSINESS PROBLEM
If the downstream CA service is down for any reason, Venafi TPP changes the status of certificate object to Error.

The scenario to reproduce this is simple
cert-manager--->Venafi TPP--->MSCA

cert-manager and MSCA could be replaced with any consumer and provider.

  • Request a certificate using cert-manager
  • Stop the MSCA service
  • Trigger a certificate renewal using cert-manager
  • As expected the renewal fails because Venafi cannot reach the downstream MSCA service
  • Renewal fails with a proper error that can be seen in the CertificateRequest resource
  • Venafi TPP during it's attempt to reach MSCA fails and marks the status of the certificate object as "Error"
  • Start the MSCA service
  • Trigger a manual renewal again.
  • This fails and there is no recovery. Unless the certificate object is reset any attempts to renew this certificate results in Error

PROPOSED SOLUTION
vCert provides a mechanism to reset the certificate object so consumers can attempt to heal the situation.

CURRENT ALTERNATIVES
Currently, the only way to recover is to manually reset the certificate object in the UI and retry a renewal via API.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the vCert certificate-renewal and API entry points involved in Venafi TPP certificate objects, then compare them with the existing reset mechanism mentioned in the issue. Done means a certificate object left in Error after a downstream MSCA failure can be reset and successfully renewed through the API without manual UI recovery.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.