Conditional Access: add renewal marker to generated SCEP profile#45662
Conditional Access: add renewal marker to generated SCEP profile#45662mostlikelee wants to merge 1 commit into
Conversation
The Fleet-generated Conditional Access SCEP profile now includes $FLEET_VAR_CERTIFICATE_RENEWAL_ID in the cert Subject OU. With Decision 2.6's opt-in framing, the marker is optional — but for Conditional Access specifically Fleet owns the entire CA, so including it by default activates auto-renewal out of the box without requiring customers to manually edit the profile. Customer impact: - New setups: deploy the profile from the Conditional Access UI and auto-renewal works automatically. - Existing setups (pre-4.86): re-download and re-deploy the profile once to opt into auto-renewal. The published Conditional Access guide's "Automatic renewal for this certificate is coming soon" note can be removed once this lands.
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
WalkthroughThis PR adds the Fleet certificate renewal marker ( Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 40639-cert-renew #45662 +/- ##
===================================================
Coverage ? 66.76%
===================================================
Files ? 2746
Lines ? 219484
Branches ? 10831
===================================================
Hits ? 146539
Misses ? 59707
Partials ? 13238
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
mostlikelee
changed the title
2 participants
Related issue: Resolves #45580
What this PR does
Adds
\$FLEET_VAR_CERTIFICATE_RENEWAL_IDto the SCEP payload's Subject OU in the Fleet-generated Conditional Access profile (server/service/conditional_access_idp.go:66-79). With the marker present, auto-renewal activates by default for new Conditional Access deployments.Why this is needed
Under Decision 2.6, the renewal marker is opt-in — profiles without it work but don't auto-renew. For Conditional Access specifically, Fleet owns both the CA and the profile template, so there's no opt-out use case: every Conditional Access customer wants their cert to auto-renew before the 1-year-and-33-days expiry. Adding the marker to the template means customers get auto-renewal without manually editing the profile they copy out of the UI.
Fleet's Conditional Access SCEP CA mints the cert (
ee/server/service/condaccess/config.go:33-62) and preserves Subject OU in issued certs — no external-CA cooperation risk.Customer impact
The published Conditional Access guide's "Automatic renewal for this certificate is coming soon" line should be removed once this lands (covered in #44348).
Checklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)Testing
Summary by CodeRabbit
New Features
Tests