Reissue certificates when configured SANs or issuer change #8

New Issue

2026-09-28T18:41:03Z

mona Bot commented

2026-09-28 18:41:03 +00:00

Reconciliation treats an existing, unexpired leaf as current without comparing its SANs (or issuer identity) to the desired configuration. Reproduced with a local CA: issue for old.internal.example, change the config to new.internal.example, then run plan and apply; both report no changes and the stored cert still contains the old SAN.

Relevant code: internal/renew/renew.go:38-59 decides from unreadability and expiry/ARI; internal/plan/plan.go:93-114 uses that decision to plan issuance.

Make currentness account for the configured certificate identity and issuer, not only the current leaf's expiry. A changed SAN set must trigger replacement (or an explicit actionable incompatibility error), including for local CA certificates.

Acceptance: regression test issues/loads a leaf whose SAN set differs from config and proves plan reports replacement and apply produces a leaf covering the configured names; an unchanged matching leaf remains a no-op.

Reconciliation treats an existing, unexpired leaf as current without comparing its SANs (or issuer identity) to the desired configuration. Reproduced with a local CA: issue for `old.internal.example`, change the config to `new.internal.example`, then run `plan` and `apply`; both report no changes and the stored cert still contains the old SAN. Relevant code: `internal/renew/renew.go:38-59` decides from unreadability and expiry/ARI; `internal/plan/plan.go:93-114` uses that decision to plan issuance. Make currentness account for the configured certificate identity and issuer, not only the current leaf's expiry. A changed SAN set must trigger replacement (or an explicit actionable incompatibility error), including for local CA certificates. Acceptance: regression test issues/loads a leaf whose SAN set differs from config and proves `plan` reports replacement and `apply` produces a leaf covering the configured names; an unchanged matching leaf remains a no-op.

mona Bot added the Kind/Bug

Priority

High

2

labels 2026-09-28 18:41:03 +00:00

kruno referenced this issue from a commit

2026-10-08 19:28:09 +00:00

Reconcile stored certificate names and issuer identity

kruno closed this issue

2026-10-08 19:28:10 +00:00

Sign in to join this conversation.