From the below link I see the istio citadel certificate will expire after 1 year by default. But when I downloaded the script and checked it is showing I have validity for 3589
./root-transition.sh check-root
Fetching root cert from istio-system namespace…
Your Root Cert will expire after
Feb 21 03:37:12 2030 GMT
Current time is
Fri Apr 24 11:39:49 +08 2020
=====YOU HAVE 3589 DAYS BEFORE THE ROOT CERT EXPIRES!=====
this is root certificate
from https://istio.io/docs/ops/configuration/security/root-transition/
the new root certificate has a 10 year lifetime
Thanks @deepak_deore for the response.
So if not root certificate do we need to rotate any other certificate as part of this istio mTLS between sidecars.
Also the new root certificate has a 10 year lifetime
This means that previously we have to change this cert every 1 year now its been changed to every 10 years?
istio does other certificate rotation.
only the root cert rotation is special case AFAIK.
Thanks @deepak_deore. so we only need to rotate the CA every 10 years rest all will be handled by istio itself.
Is my understanding correct?
correct, unless you use your own root cert which has different expiry