Documentation on rotating the root certificate

[srinisudharsan]

While it is not common, there is always the possibility that one would have to rotate the root CA. Could you add documentation on how to do it without downtime?

[braunsonm]

Also would like to know this. Is it possible since you'd need to trust the old and new at the same time?
We were actually looking to use an intermediate CA so would it be possible to trust the root, renew the intermediate, then change back to only trusting the intermediate?

[SpectralHiss]

Your trust store PEM could be two different roots at the same time, so even if there is no intermediate you can just append root1 and root2 in a transition phase, rotate all pods and then remove root1 from the trust store.

[rams3sh]

Hey @SpectralHiss

I came across this issue while researching root CA rotation support for istio-csr. I realize the thread is almost 3 years old, but is there any documented or recommended approach for root CA rotation as of now?

Also, Istio now seems to support automated root CA rotation natively using cacerts. Here’s a relevant KubeCon talk and demo repo:

KubeCon talk
Demo repo

In this model, istiod sends new updates with PCDS (Proxy config data stream) for Cacerts updates when environment variable ISTIO_MULTIROOT_MESH is enabled , istio-csr could probably implement that. The istio-agent has a feature to receive and handle PCDS stream accordingly which could be enabled by PROXY_CONFIG_XDS_AGENT environment variable.