Migrate choria certificates from un Puppet CA to another CA

[grandich]

Hi,

We have a choria setup which uses Puppet CA certificates. We are replacing our Puppet CA, and pointing our puppet agents to the new one. In doing so, we are regenerating and signing new client certificates, but now choria server (agents), say:

Initial connection to the Broker failed on try 3483: x509: certificate signed by unknown authority

Can choria broker use two different Puppet CA's while we migrate from one CA to the other?
Do I need two choria brokers in the process of Puppet CA migration?

Thank you

[ripienaar]

One cannot accept multiple CAs at present no. Bit of a difficult migration.

Would your down time be very long? There are some options but quite annoying ones.

[grandich]

We need to regenerate certs in 13k nodes and in the process we are testing a new Puppet Server installation with possible code changes. The rollout will last various days.

The transition of puppet agents to the new puppetserver per se is not an issue because it is gradually controlled and monitored.

I understand that de 'main switch' of certificates must be done in choria broker, right?

[ripienaar]

That's pretty bad, I can perhaps show you how to configure a NATS server that you could perhaps point your current fleet to - it would have the existing certs - and your choria cluster would then have the new certs and as your machines migrate they would move to the new server.

But that's only part of the problem, choria client certificates are signed by the CA and any given choria server will not let a client from a foreign CA communicate with it (CA is the point of trustworthy issuance of users) and I believe that too would not allow multiple CAs to be used.

@vjanelle do you have any ideas? I dont think I can trust multiple CAs can we?

[grandich]

Thanks. In the meantime I will setup a second choria broker to accept migrated choria clients with the downside of split orchestration.

[ripienaar]

We're (slowly, super carefully etc) moving away from the whole CA centered approach for all things. Already we can deploy without full CA verification while remaining secure but today still requests are signed by a cert at all times, eventually I want to look to provide an alternative for that too.

This will greatly improve the story for big shops - also struggling under that myself. Today though I dont think there's a good option :(