1620424 - MDC1 puppetmaster CA expire on 04/24/2020

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[Jake Watkins [:dividehex]]

While working on revoking the AWS puppetmaster certificates, I noticed the MDC1 puppetmasters are set to expire fairly soon. We will need to reissue intermediate CA certs for these two before that date.

Not After : Apr 24 16:04:46 2020 GMT
Subject: CN=CA on releng-puppet1.srv.releng.mdc1.mozilla.com

Not After : Apr 24 16:01:55 2020 GMT
Subject: CN=CA on releng-puppet2.srv.releng.mdc1.mozilla.com

Comment 1

[Jake Watkins [:dividehex]]

Attachment: GitHub Pull Request - invalidate soon to expire CAs hosts

This PR will cause any puppet agents with certs issued from the expired hosts to redirect to the mdc2 hosts. We'll add them back after the mdc1 hosts have new CA certs issued.

Comment 2

[Jake Watkins [:dividehex]]

Attachment: GitHub Pull Request - add mdc1 puppetmasters back to the valid CAs list

Certs have been changed out. These can be added back now.

Comment 3

[Jake Watkins [:dividehex]]

Certs have been renewed and installed

notAfter=Apr 23 17:27:32 2023 GMT
subject= /CN=CA on releng-puppet1.srv.releng.mdc1.mozilla.com

notAfter=Apr 23 17:40:28 2023 GMT
subject= /CN=CA on releng-puppet2.srv.releng.mdc1.mozilla.com