Incomplete certificate renewal documentation

What is the issue?

Hi, as requested on Slack.

I noticed that the specific section of the documentation below mentions renewing the issuer cert in the case of a renewed trust anchor, but doesn’t cover renewing the issuer cert without renewing the trust anchor as well:

https://linkerd.io/2.12/tasks/manually-rotating-control-plane-tls-credentials/#rotating-the-identity-issuer-certificate

This new issuer certificate is signed by our new trust anchor, which is why it was critical to install the new trust anchor bundle (as outlined in the previous section).

However, further up the same page in this section it says that we can avoid downtime by bundling the new and old trust anchors together:

https://linkerd.io/2.12/tasks/manually-rotating-control-plane-tls-credentials/#read-the-current-trust-anchor-certificate-from-the-cluster

I think there should be an additional section covering renewing the identity issuer cert without renewing the trust anchor, in order to allow users to facilitate a no-downtime rotation of just the identity issuer cert.

Additionally, I believe step bundle could be used to put the old issuer and new issuer certificate together into a bundle in just the same way the trust anchor is bundled together in the document. This could help alleviate some of the pain of rotating issuer certs because both the old and new trust anchor, and both the old and new issuer certs would be available and therefore it wouldn't break the trust chain at any point.

How can it be reproduced?

Read the docs

Logs, error output, etc

N/A

output of linkerd check -o short

N/A

Environment

N/A

Possible solution

1. Recommend to bundle the old and new issuer certificate.
2. Add instructions to renew the issuer while reusing the existing trust anchor signing key
3. Explain why we need a new issuer key, or else also document how we can generate the new issuer cert using an existing issuer key with either a new or existing trust anchor cert and key.

Additional context

No response

Would you like to work on fixing this bug?

No response

Start with the linked 2.12 documentation page, especially “Read the current trust anchor certificate from the cluster” and “Rotating the identity issuer certificate.” Compare the documented trust-anchor rotation with the requested issuer-only rotation and verify the proposed step bundle behavior. Done means the page explains the issuer-only procedure, certificate/key choices, bundling, and no-downtime considerations.