Changing the default root CA signer certificate

All deployments, by default, create certificates that are signed by a common root CA certificate. You can use the operator-generated root CA, or provide your own root CA signer certificate.

About this task

If the CP4BA custom resource root_ca_secret parameter does not have a value or does not exist, the operator creates a default root CA secret, named icp4a-root-ca, and uses it to generate self-signed certificates. The expiration period for these self-signed certificates is two years. The CP4BA operator automatically detects the expiration date 24 hours before it expires, it then renews the self-signed certificates and restarts the pods. No further action is needed for the certificates to continue to work.

If your policy requires a recognized certificate authority to sign the certificates, you can provide your own root CA. To use your own root CA certificate, obtain or prepare the CA certificate and create a Kubernetes secret for it and set the secret name in the root_ca_secret parameter under the shared_configuration section in your custom resource .yaml file. If you have multiple deployments and you want to use the same root CA, copy the secret and use the same certificates in each deployment in separate namespaces.

If you want to use your own root CA certificate, use the following steps to add it to the operator.

Procedure

Obtain or generate a rootca.key (private key) file and a rootca.crt (certificate) file.

The following example shows how to generate a root CA by using OpenSSL.

openssl req -nodes -x509 -newkey rsa:4096 -keyout rootca.key -out rootca.crt \
-days 730 -extensions v3_req -config icp4a-ca.cnf

The command produces the private key file rootca.key and the certificate rootca.crt. The command also needs a configuration file icp4a-ca.cnf. The following lines show an example of a .cnf file.

[ req ]
prompt = no
distinguished_name = dn
req_extensions = v3_req

[ dn ]
CN=Automation
O=IBM

[ v3_req ]
basicConstraints=critical,CA:true,pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
extendedKeyUsage = clientAuth, serverAuth
authorityKeyIdentifier=keyid,issuer
subjectKeyIdentifier=hash

You can change the [ dn ] section with the names that you want.

Create a TLS secret for the root_ca_secret parameter by using your signer certificate.
The following example command creates a TLS secret for your root CA.
```
kubectl create secret tls root-ca –-key=rootca.key –-cert=rootca.crt
```
For more information, see TLS secrets .
Update the parameter value for the operator to use your secret.
```
shared_configuration:
    root_ca_secret: 'root-ca'
```