Skip to content

update testing/environments/docker/elasticsearch/pki certs#46337

Merged
AndersonQ merged 2 commits intoelastic:mainfrom
AndersonQ:fix-libbeat-TestCAPinning
Sep 2, 2025
Merged

update testing/environments/docker/elasticsearch/pki certs#46337
AndersonQ merged 2 commits intoelastic:mainfrom
AndersonQ:fix-libbeat-TestCAPinning

Conversation

@AndersonQ
Copy link
Copy Markdown
Member

@AndersonQ AndersonQ commented Sep 1, 2025 •
edited
Loading

Proposed commit message

update environments/docker/elasticsearch/pki certs
    
     - replace the expired certificates with certificated valid for 5 years
     - restore previous naming
     - update sha256 on certificate pinning tests
     - use keys in DER format

Checklist

  • [ ] My code follows the style guidelines of this project
  • [ ] I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

  • none

How to test this PR locally

  • check the new certificates are valid for 5 yeas:
openssl x509 -noout -text -in testing/environments/docker/elasticsearch/pki/ca/ca.pem

openssl x509 -noout -text -in testing/environments/docker/elasticsearch/pki/elasticsearchssl/elasticsearchssl_cert.pem

Related issues

  • n/a

@AndersonQ AndersonQ self-assigned this Sep 1, 2025
@AndersonQ AndersonQ added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Sep 1, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 1, 2025
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Sep 1, 2025

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Sep 1, 2025

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @AndersonQ? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@AndersonQ AndersonQ added the backport-skip Skip notification from the automated backport with mergify label Sep 1, 2025
@AndersonQ AndersonQ force-pushed the fix-libbeat-TestCAPinning branch from f8a8541 to a77fc21 Compare September 1, 2025 12:09
@mauri870
Copy link
Copy Markdown
Member

mauri870 commented Sep 1, 2025

Thanks for fixing this! I’m wondering if it would make sense to generate these files as part of CI so they’re always up to date. Otherwise, we’ll run into the same issue later and have to regenerate them. If that’s not possible, what’s the validity period of the certs you generated?

@AndersonQ
Copy link
Copy Markdown
Member Author

AndersonQ commented Sep 1, 2025

the validity period of the certs you generated?

5 yeas, it's on the "how to test this PR"

I’m wondering if it would make sense to generate these files as part of CI so they’re always up to date

I was thinking about it as well. I rather have them generated on the fly as well. But first I'd like to unblock CI.
Also, from the rather quick look I had, the docker containers use them, and as far as I remember it should work everywhere, including windows. So it might need a bit more work than just changing a few lines on a test

@mauri870 mauri870 mentioned this pull request Sep 1, 2025
Merged
6 tasks
@AndersonQ
update environments/docker/elasticsearch/pki certs
c146343 
 - replace the expired certificates with certificated valid for 5 years
 - restore previous naming
 - update sha256 on certificate pinning tests
 - use keys in DER format
@AndersonQ AndersonQ force-pushed the fix-libbeat-TestCAPinning branch from a77fc21 to c146343 Compare September 1, 2025 15:09
@AndersonQ AndersonQ marked this pull request as ready for review September 1, 2025 15:10
@AndersonQ AndersonQ requested a review from a team as a code owner September 1, 2025 15:10
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 1, 2025

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@AndersonQ AndersonQ enabled auto-merge (squash) September 1, 2025 15:10
@AndersonQ AndersonQ requested a review from mauri870 September 1, 2025 15:11
@mauri870
Copy link
Copy Markdown
Member

mauri870 commented Sep 1, 2025

LGTM. I confirmed locally that the new certs are valid for 5 years.

@AndersonQ AndersonQ changed the title [wip] update testing/environments/docker/elasticsearch/pki certs update testing/environments/docker/elasticsearch/pki certs Sep 1, 2025
@AndersonQ AndersonQ merged commit c02858b into elastic:main Sep 2, 2025
209 of 211 checks passed
@rdner rdner added the backport-8.19 Automated backport to the 8.19 branch label Feb 10, 2026
mergify bot pushed a commit that referenced this pull request Feb 10, 2026
@AndersonQ @mergify
update environments/docker/elasticsearch/pki certs (#46337)
f1a5409 
 - replace the expired certificates with certificated valid for 5 years
 - restore previous naming
 - update sha256 on certificate pinning tests
 - use keys in DER format

(cherry picked from commit c02858b)

# Conflicts:
#	libbeat/tests/integration/ca_pinning_test.go
#	testing/environments/docker/elasticsearch/pki/ca/ca.crt
#	testing/environments/docker/elasticsearch/pki/ca/ca.key
#	testing/environments/docker/elasticsearch/pki/elasticsearchssl/elasticsearchssl.crt
#	testing/environments/docker/elasticsearch/pki/elasticsearchssl/elasticsearchssl.key
@mergify mergify bot mentioned this pull request Feb 10, 2026
Closed
1 task
@rdner rdner added backport-8.19 Automated backport to the 8.19 branch and removed backport-8.19 Automated backport to the 8.19 branch labels Feb 10, 2026
@rdner
Copy link
Copy Markdown
Member

rdner commented Feb 10, 2026

@Mergifyio backport 8.19

@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Feb 10, 2026 •
edited
Loading

backport 8.19

✅ Backports have been created

Details

mergify bot pushed a commit that referenced this pull request Feb 10, 2026
@AndersonQ @mergify
update environments/docker/elasticsearch/pki certs (#46337)
073487d 
 - replace the expired certificates with certificated valid for 5 years
 - restore previous naming
 - update sha256 on certificate pinning tests
 - use keys in DER format

(cherry picked from commit c02858b)
@mergify mergify bot mentioned this pull request Feb 10, 2026
Merged
1 task
pierrehilbert pushed a commit that referenced this pull request Feb 10, 2026
@mergify @AndersonQ
update environments/docker/elasticsearch/pki certs (#46337) (#48783)
94cdbd9 
- replace the expired certificates with certificated valid for 5 years
 - restore previous naming
 - update sha256 on certificate pinning tests
 - use keys in DER format

(cherry picked from commit c02858b)

Co-authored-by: Anderson Queiroz <anderson.queiroz@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mauri870 mauri870 mauri870 approved these changes

@khushijain21 khushijain21 Awaiting requested review from khushijain21 khushijain21 is a code owner automatically assigned from elastic/elastic-agent-data-plane

@VihasMakwana VihasMakwana Awaiting requested review from VihasMakwana VihasMakwana is a code owner automatically assigned from elastic/elastic-agent-data-plane

Assignees

@AndersonQ AndersonQ

Labels

backport-8.19 Automated backport to the 8.19 branch backport-skip Skip notification from the automated backport with mergify Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@AndersonQ @mauri870 @elasticmachine @rdner @khushijain21