BOSH & SSL Certificates - Rotating Certificates Smoothly

on YouTube ↗13m

" summary

Describes a three-step certificate rotation that uses CredHub and the Kube App transitional-flag workflow: create a new CA with transitional set and deploy so every VM gets both CAs, flip the transitional flag to the old CA and run mass-regenerate to reissue all end-entity certs, then remove transitional from the old CA and deploy. Claims eliminate no ops-files maintenance and manual ops-file juggling; warns a BOSH Director bug needs a patch (it can drop one cert and hides diffs).

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 2:23Old rotation problems
3. 4:49New method via Kube App
4. 5:51How new process works
5. 8:55Pros and cons
6. 10:20Documentation and resources
7. 11:45Q&A

" related talks

• 27mPreventing Doomsday: x509 Certificates in Cloud FoundryTom Mitchell, David Dobmeier · Cloud Foundry Summit North America 2019
• 15mCertificates in KubernetesIlya Margolin · ContainerDays Hamburg 2018
• 23mService Mesh Root Cert Rotation: No Downtime, No Problem!Zhonghu Xu, Jianpeng He · Istio Day Europe 2024
• 19mSecurity with Certificates in KubernetesUnnati Mishra, Akshat Khanna · CloudOpen @ Open Source Summit Europe 2022
• 36mCertifik8s: All You Need to Know About Certificates in KubernetesAlexander Brand · KubeCon + CloudNativeCon North America 2017
• 10mLightning Talk: Your Wish Is Our Command: Declarative Certificate Management in a...Jackie Elliott · ServiceMeshCon North America 2022
• 31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-managerErik Godding Boye, Tim Ramlot · KubeCon + CloudNativeCon Europe 2025
• 22mIdentity with certificates in KubernetesAkshat Khanna · ContainerDays 2022