Jira (PUP-3262) By default, the cadir should be separated from the ssldir

[Christopher Price (JIRA)]

Christopher Price assigned an issue to Unassigned

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir Change By: Christopher Price Assignee: Christopher Price Add Comment

This message was sent by Atlassian JIRA (v6.4.5#64020-sha1:78acd6c)

[Adrien Thebo (JIRA)]

Adrien Thebo updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Adrien Thebo Labels: triaged

Add Comment

This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe)

[Moses Mendoza (JIRA)]

Moses Mendoza updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Moses Mendoza Labels: triaged

Add Comment

[Charlie Sharpsteen (JIRA)]

Charlie Sharpsteen updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Charlie Sharpsteen CS Priority: Needs Priority

Add Comment

[Owen Rodabaugh (JIRA)]

Owen Rodabaugh updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Owen Rodabaugh CS Priority: Needs Priority Major CS Impact: It would be good to have something which automatically backs up this directory as we see a support case where someone has deleted their CAdir every few weeks.  Lacking that no putting the CAdir in the same place as the ssldir would be a good step. While we have worked to change the docs to say customers should move this dir there is advice elsewhere on the internet saying to delete it. Customers who do not have a backup are faced with a pretty big task of rekeying all of their agents. While bolt can help with this if the customer has setup ssh keys(many do not or do not want to), tasks in PE can't because they rely on this same SSL infrastructure. CS Severity: 4 - Major CS Business Value: 5 - $$$$$$ CS Frequency: 1 - 1-5% of Customers

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Josh Cooper Sub-team: Server

Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Josh Cooper Fix Version/s: PUP 6.0.0

Add Comment

[Charlie Sharpsteen (JIRA)]

Charlie Sharpsteen updated an issue

Puppet / PUP-3262 By default, the cadir should be separated from the ssldir

Change By: Charlie Sharpsteen Affects Version/s: PUP 4.10.10 Affects Version/s: PUP 5.4.0

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir ping Justin Stoller Maggie Dreyer we should probably do this sooner rather than later, to understand and react to any downstream impact.

Add Comment

[Eric Sorenson (JIRA)]

Eric Sorenson commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

Justin Stoller and I talked through this; a bit more guidance: the new CA dir ought to be under /etc/puppetlabs/puppetserver/ca, though the location should still be relocatable via a puppetserver.conf setting new installations should use that by default; existing installations should look in the old /etc/puppetlabs/puppet/ssl/ca directory and use that without modification if it exists (i.e. do not try to auto-migrate people's CA certs. that path lies madness!) the CLI tool from SERVER-2162 ought to provide an affordance for people to migrate an existing CA (whether single root+intermediate combo or root-only) from the old setup into a root+intermediate combo in the new location if we migrate it should also bring over the old CRL the implications on PE installations, both new and upgrades, need to be considered as part of this work (but under separate tickets)

Add Comment

[Eric Thompson (JIRA)]

Eric Thompson commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

consider backup and restore for this as well

Add Comment

[Eric Thompson (JIRA)]

Eric Thompson commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

Maggie Dreyer to break this one up more or less around the bullets above

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

Eric Sorenson When we say that existing installations should look in the old CA dir first, do we mean to only look in the default location, or to respect the old setting? This has implications for when/how we remove the CA's Ruby dependency.

Add Comment

[Eric Sorenson (JIRA)]

Eric Sorenson commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

Maggie Dreyer Hm, I feel like we need to respect the previous setting - the goal is to avoid a hard break for sites who are upgrading, and I think that includes the case where they've relocated the ssl dir via setting.

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

Created PUP-8918 to break down and track this work.

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

This didn't make it into Puppet 6. See the above epic.

Add Comment

[Charlie Sharpsteen (JIRA)]

Charlie Sharpsteen commented on PUP-3262

Re: By default, the cadir should be separated from the ssldir

This continues to be a problem and is easy to trigger accidentally: https://tickets.puppetlabs.com/browse/ENTERPRISE-1274

Add Comment

[Charlie Sharpsteen (JIRA)]

Charlie Sharpsteen updated an issue

Puppet / PUP-3262

By default, the cadir should be separated from the ssldir

Change By: Charlie Sharpsteen Fix Version/s: PUP 6.0.0

Add Comment