Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Select view

Select search mode

 
17 of 17

PMMv3 renew self signed certificates

Description

User story:
As an Admin installed PMM, I need to have "more correct" certificates inside PMM, so they are self-signed but do not cause an additional warning by security tools because they are outdated

UI/UX:
N/A

Acceptance criteria

  • Installed or updated version of PMM always have not-expired self-signed sertificates

  • A special precaution should be taken not to replace the public certificate the user may have mounted to /srv/nginx/ directory;


Out of scope:

  • UI for certificate management

  • Integration with let's encrypt or related service


Suggested implementation:
TBD

How to test:
TBD

Details:
TBD

For testing purposes, I've installed through docker PMM v. 2.11.0 which was released back in Oct 2020.

https://www.percona.com/doc/percona-monitoring-and-management/2.x/release-notes/2.11.0.html 

 

This is what the self signed certificate was reporting as an expiration date

[centos@ip-192-168-2-206 ~]$ echo -n | openssl s_client -connect 127.0.0.1:443 | openssl x509 -noout -dates depth=0 O = Main Org. verify error:num=18:self signed certificate verify return:1 depth=0 O = Main Org. verify error:num=10:certificate has expired notAfter=Oct 14 16:50:17 2021 GMT verify return:1 depth=0 O = Main Org. notAfter=Oct 14 16:50:17 2021 GMT verify return:1 DONE notBefore=Oct 14 16:50:17 2020 GMT notAfter=Oct 14 16:50:17 2021 GMT

so it appears that certificate is valid for 365 days only.

 

I've then performed an upgrade through the UI from 2.11.0 to 2.23.0

2.23.0 was released on Oct 2021

https://www.percona.com/doc/percona-monitoring-and-management/2.x/release-notes/2.23.0.html

 

Checking the certificate again it seems that this was not renewed

[centos@ip-192-168-2-206 ~]$ echo -n | openssl s_client -connect 127.0.0.1:443 | openssl x509 -noout -dates depth=0 O = Main Org. verify error:num=18:self signed certificate verify return:1 depth=0 O = Main Org. verify error:num=10:certificate has expired notAfter=Oct 14 16:50:17 2021 GMT verify return:1 depth=0 O = Main Org. notAfter=Oct 14 16:50:17 2021 GMT verify return:1 DONE notBefore=Oct 14 16:50:17 2020 GMT notAfter=Oct 14 16:50:17 2021 GMT

I would expect / suggest:

  1. Default certificates to get auto-renewed if these are going to expire (even without an upgrade)

  2. Default certificates to be replaced when an upgrade happens

How to test

Refinement notes

  • get use old pmm certificate, restart pmm and check for certificate update + custom user cert was not replaced / affected

How to document

  • would be great to warn users to not to use our certs in PROD

Confluence content

mentioned on

Smart Checklist

Details

Assignee

Reporter

Priority

Components

Labels

Needs QA

Yes

Needs Doc

Yes

Planned Version/s

Story Points

Affects versions

Smart Checklist

Created November 8, 2021 at 9:51 AM
Updated December 18, 2024 at 2:00 PM
Configure

Activity

Show:

Roma Novikov November 6, 2024 at 10:42 AM

Since this issue wasn’t resolved before PMM v3 and we do not anticipate it being a major problem in v3—given that there will be no package update method making this issue more significant—we will keep it on record for now. It still needs to be reviewed, as more problems may be discovered.

Ananias Tsalouchidis November 8, 2021 at 12:34 PM

Hello   and thanks for taking a look.

Self signed certs should ideally not being used so It's mostly "make self-signed more correct". This is also kind of a good impression as leaving certs to expire does not seem nice.

There is no blocker but since agents talk to the server over encrypted channels that would be good to have an active cert even if self signed.

Using expired certs also causes some noise as security tools may report the PMM instance as vulnerable because it is using an expired cert - assuming that self signed are accepted - (this is how it all started).

 

Thanks,

Ananias.

Roma Novikov November 8, 2021 at 12:19 PM

Hi

Can you explain the problem from the user's side? Are the users affected? 
I've tested mentioned scenario and can't see the problem( as at first place I'm "accepting an insecure connection," so we let PMM work with  "whatever the certificate we have." 

I'm trying to understand if this request is about "make self-signed more correct" or there are some problems to users already, and we need to solve them faster? 

Flag notifications