Support for re-issuing the mTLS certificates if root/intermediate CA changes

[ra-grover]

We use our own rootCA and we had a case where the intermediate CA certificate got expired, which we replaced but we had to restart all application workloads including pilot (istiod) and ingressgateways.
Is it possible for Istiod to push the newly re-issued certificates to each connected istio-proxy so that the restarts are not required ?

I went through some code and realized that SDS is served on istio-proxy and that SDS server has a SecretManager which has a client that calls istiod CA to issue a CSR and it gets the certificate, can someone please confirm if the there is no capability from istiod side to push certificates on the proxy ? Looks like proxy can just pull the certificates when the envoy agent asks for it.

[zirain]

IIRC, it's unnecessary to reboot when you just change intermediate certificate from same root CA.

[ra-grover]

Yeah, I understand that but in our case the intermediate got expired. So I am just trying to understand if there is a way that istiod issues new certs on the renewed intermediate and distributes it to the connected istio-proxies such that a restart is not required for the application workload and the ingress.

[ra-grover]

Hi @zirain Sorry to be tagging you, but would request you to have a look at the above response.

I needed to restart my application workloads as my intermediate CA cert expire, so just trying to understand if there is any way that istiod can push new renewed certificates signed with the renewed intermediate CA cert (after expiry) to all running istio-proxies in the mesh.
I also acknowledge that after SECRET_TTL * SECRET_GRACE_PERIOD_RATIO , isito proxy will pull a new cert. All I am looking is a confirmation from community if there is a "push" mechanism also from istiod to push renewed certs to existing application workloads.

Thanks in advance!