Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DOCS] Steps for updating TLS certificates #73781

Merged
merged 38 commits into from Jul 28, 2021
Merged

[DOCS] Steps for updating TLS certificates #73781

merged 38 commits into from Jul 28, 2021

Conversation

lockewritesdocs
Copy link
Contributor

@lockewritesdocs lockewritesdocs commented Jun 4, 2021 •
edited

Adds documentation for updating TLS certificates both when the CA remains the same and when it changes. This information focuses on PCKS#12 certificates. We can add documentation for updating PEM certificates in a separate PR.

Preview link: https://elasticsearch_73781.docs-preview.app.elstc.co/guide/en/elasticsearch/reference/master/update-node-certs.html

Closes #63953
Relates to #1644

@lockewritesdocs lockewritesdocs self-assigned this Jun 4, 2021
@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs lockewritesdocs marked this pull request as ready for review June 10, 2021 20:16
@lockewritesdocs lockewritesdocs added :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) >docs General docs changes v7.13.2 v7.14.0 v8.0.0 labels Jun 10, 2021
@elasticmachine elasticmachine added the Team:Docs Meta label for docs team label Jun 10, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-docs (Team:Docs)

@elasticmachine elasticmachine added the Team:Security Meta label for security team label Jun 10, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

jkakavas
jkakavas reviewed Jun 21, 2021
View reviewed changes
Copy link
Member

@jkakavas jkakavas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for tackling this beast Adam. I added some comments on the transport layer instructions which probably affect the http in the same way. Happy to chat about anything that it is not clear

x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
x-pack/docs/en/security/securing-communications/update-tls-certificates.asciidoc Outdated Show resolved Hide resolved
@jkakavas
Apply suggestions from code review
6cd5cec 
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs
Copy link
Contributor Author

@elasticmachine update branch

@lockewritesdocs lockewritesdocs added v7.12.2 auto-backport Automatically create backport pull requests when merged v7.14.0 labels Jul 28, 2021
@lockewritesdocs lockewritesdocs merged commit 73e3b60 into elastic:master Jul 28, 2021
@lockewritesdocs lockewritesdocs deleted the docs__update-tls-certs branch July 28, 2021 18:54
elasticsearchmachine pushed a commit to elasticsearchmachine/elasticsearch that referenced this pull request Jul 28, 2021
@elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (elastic#73781)
0997dac 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
@elasticsearchmachine elasticsearchmachine mentioned this pull request Jul 28, 2021
Closed
elasticsearchmachine pushed a commit to elasticsearchmachine/elasticsearch that referenced this pull request Jul 28, 2021
@elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (elastic#73781)
f52786d 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
@elasticsearchmachine elasticsearchmachine mentioned this pull request Jul 28, 2021
Merged
elasticsearchmachine pushed a commit to elasticsearchmachine/elasticsearch that referenced this pull request Jul 28, 2021
@elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (elastic#73781)
32fa839 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
@elasticsearchmachine elasticsearchmachine mentioned this pull request Jul 28, 2021
Merged
elasticsearchmachine pushed a commit to elasticsearchmachine/elasticsearch that referenced this pull request Jul 28, 2021
@elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (elastic#73781)
4c1368c 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
@elasticsearchmachine elasticsearchmachine mentioned this pull request Jul 28, 2021
Merged
@elasticsearchmachine
Copy link
Collaborator

💚 Backport successful

Status Branch Result
✅ 7.12
✅ 7.13
✅ 7.14
✅ 7.x

lockewritesdocs pushed a commit that referenced this pull request Jul 28, 2021
@elasticsearchmachine @elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (#73781) (#75812)
69f0be6 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

Co-authored-by: Adam Locke <adam.locke@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
lockewritesdocs pushed a commit that referenced this pull request Jul 29, 2021
@elasticsearchmachine @elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (#73781) (#75813)
8c441ec 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

Co-authored-by: Adam Locke <adam.locke@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
lockewritesdocs pushed a commit that referenced this pull request Jul 29, 2021
@elasticsearchmachine @elasticmachine @jkakavas
[DOCS] Steps for updating TLS certificates (#73781) (#75814)
381f4a8 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

Co-authored-by: Adam Locke <adam.locke@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
ywangd pushed a commit to ywangd/elasticsearch that referenced this pull request Jul 30, 2021
@elasticmachine @jkakavas @ywangd
[DOCS] Steps for updating TLS certificates (elastic#73781)
6bac600 
* [DOCS] Steps for updating TLS certificates

* Updates for changing CA

* Updates for rotating certs with a new CA

* Add instructions for generating HTTP certs with a new CA

* Add steps for creating HTTP certs with new CA

* Clarify note about cluser restart and other edits

* Clarifying scenarios

* Apply suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Incorporating review feedback and making necessary changes

* Clarifications and changes regarding restarts

* Remove errant --pem in basic security setup

* Incorporate suggestions from code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Many, many updates. But good ones.

* Add languages for snippets

* Reorder steps to reference rolling restart throughout for consistency

* Add clarifying what's next steps

* Add instructions for updating Kibana certificate

* Apply suggestions from Ioannis' stellar code review

Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>

* Update instructions to use a single keystore, plus other review changes

* Incorporating another round of review comments

* Minor updates from reviewer feedback

* Clarifying examples and fixing numbering

* Skip tests that are creating unnecessary noise

* Quieting other tests

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Ioannis Kakavas <ikakavas@protonmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@legrego legrego legrego left review comments

@jkakavas jkakavas jkakavas left review comments

@tvernum tvernum tvernum approved these changes

Assignees

@lockewritesdocs lockewritesdocs

Labels
auto-backport Automatically create backport pull requests when merged >docs General docs changes :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Docs Meta label for docs team Team:Security Meta label for security team v7.13.5 v7.14.0 v7.15.0 v8.0.0-alpha1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Document how to update existing TLS certificates in a cluster
9 participants
@lockewritesdocs @elasticmachine @jkakavas @elasticsearchmachine @tvernum @legrego @joegallo @mark-vieira @danhermann