Commit 7079a7d
committed
MB-61592: Re-trust OOTB CA when node cert regenerated
When regenerating a node cert, the OOTB CA that the new node cert is
certified by may not still be in the cluster's list of trusted certs.
If n2n encryption is enabled, then this could leave the cluster in a
state where it can't communicate with the node, as it won't trust that
node's cert.
To avoid this foot-gun, we should add the OOTB CA cert back to the
cluster's trusted cert list, when regenerating a node cert without at
the same time regenerating the root CA.
Change-Id: I69c43e036579b1cb04f281cb2ff60af756d7b2bf
Reviewed-on: https://review.couchbase.org/c/ns_server/+/232438
Well-Formed: Build Bot <[email protected]>
Tested-by: Peter Searby <[email protected]>
Well-Formed: Restriction Checker
Reviewed-by: Timofey Barmin <[email protected]>1 parent 345fafb commit 7079a7d
File tree
2 files changed
+363
-63
lines changed- cluster_tests/testsets
- src
2 files changed
+363
-63
lines changed
0 commit comments