Consider shorter X.509 certificate lifetimes

[tashian]

Change Request

1. Describe what you find is inappropriate or missing in the existing docs.

The certificate-based authentication docs suggest minting 1,000-year TLS certificates for authentication. 1,000 years is a very long validity period. Have you considered 90 days or less?

2. Describe your suggestion or addition.

Short-lived certificates are much safer, especially for client authentication (where client certs and keys are more likely to moved around and more easily exfiltrated). If nothing else, it'd be great for the docs to point to resources on best practices for certificate management in production. For configuring automated renewal, it'd also be helpful to know when certificate files are read by TiDB. Does TiDB need to be restarted? Sent a HUP signal? Or, are certificates files read on every new connection?

A more gourmet option is for TiDB to build in support for being an ACME client (the protocol used by Let's Encrypt).

3. Provide some reference materials (documents, websites, etc) if you could.

My company (Smallstep Labs) has created an open-source X.509 CA that makes minting and renewing certificates easy. Here's a tutorial for automating x.509 certificate lifecycle management.

[github-actions]

This issue is stale because it has been open for 60 days with no activity. If no comment has been made and the lifecycle/stale label is not removed, this issue will be closed in 15 days.

[github-actions]

This issue will be closed because it has been stale for 15 days with no activity. If you still have any question about this issue, feel free to reopen it or create a new one.

[TomShawn]

@tashian Thanks very much for such detailed feedback!
@bb7133 Shall we consider updating this document?

[tashian]

You're welcome @TomShawn and I'm happy to discuss further

[dveeden]

I think there are three separate things in this issue:

1. A feature request for ACME support in TiDB
2. A request to document the certificate rollover procedure
3. Use a 90 days or less validity to better align with best practices

I think the two different scenarios here are:

• Manual certificate renewal: Here a 1 year or so validity period probably makes sense.
• Automated certificate renewal: With the tools described above or with something like Netflix Lemur