feat: auto-renew KMIP server TLS certificates - #14
Conversation
Certificate material now lives in an atomically-swapped snapshot served per handshake via GetConfigForClient. A background loop renews the certificate at 2/3 of its lifetime, keeps serving the old certificate and retries with backoff on failure (capped at 1m once expired), and on 401/403 invokes the new RefreshAccessToken callback so AWS-enrolled servers can re-authenticate.
|
💬 Discussion in Slack: #pr-review-infisical-kmip-14-feat-auto-renew-kmip-server-tls-certificates Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
|
| Filename | Overview |
|---|---|
| kmip.go | Implements certificate fetching, atomic renewal, dynamic TLS configuration, and token-refresh retries; renewal can replace a working snapshot with a mismatched certificate/key pair. |
| server.go | Adds synchronized token access, atomic certificate-state storage, and dynamic serial-number headers without a separate identified defect. |
Reviews (1): Last reviewed commit: "feat: auto-renew server TLS certificates..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The platform now logs a dedicated kmip-server-connect audit event, so the daemon no longer reports renewal status.
Floor the wait between renewals at one minute so an already-past renewal point cannot trigger back-to-back issuance, bound the certificate fetch with a 60s timeout so a hung API call fails into the retry cycle instead of stalling renewal, round the expires-in log to seconds, and restore a truncated comment.
2 participants
KMIP servers now renew their TLS certificates automatically in the background, so new certificates are picked up without a restart or dropped connections. On auth failure the new RefreshAccessToken callback lets the CLI re-authenticate (companions: Infisical/cli#354, Infisical/infisical#7542).