As a Security Server Administrator I want to be notified if automatic certificate renewal using ACME fails or succeeds so that I know what the certificate renewal status is.
Description
Implementation notes
None
is blocked by
Activity
Show:
Done
Details
Assignee
Reporter
Petteri Kivimäki
Petteri KivimäkiTarget Version/s
Story Points
8
Sprint
None
Fix versions
Priority
Low
Parent
Created July 9, 2024 at 1:14 PM
Updated November 18, 2024 at 7:00 PM
Resolved November 18, 2024 at 7:00 PM
Support for renewing auth and sign certificates automatically using ACME was implemented in XRDDEV-2536. The implementation includes showing renewal status on the SIGN and AUTH keys page. In addition, a global warning on top of the Security Server UI is shown if the renewal has failed for some reason. In order to see the renewal status, the Security Server Administrator must log in to the Security Server UI.
Since the Security Server stops operating without valid auth and sign certs, it's important to notify the Security Server admin through an external channel immediately when the renewal operation fails or succeeds. In practice, the admin must be notified by email. The email address configured in the
acme.yml
configuration file is used as a recipient. Similarly, the admin should be notified about successful renewal operations too.The Security Server should use an external email server for sending the notification emails. In other words, the Security Server will act as an email client. The email server configuration details are stored in the
acme.yml
configuration file or in some other configuration file. Also, it’s important that the Security Server admin is able to test the email configuration by sending a test email from the Security Server UI, e.g., from the diagnostics page. Also, the diagnostics page should show the success and failure notification configuration status (enabled / disabled) and are the connection details present in the configuration file. The recipient’s email configured inacme.yml
should be shown in the diagnostics page too. If all the required configuration details are present, it’s possible to send a test email to the recipient. In that way, the admin can validate that the configuration is correct and the Security Server is able to establish a connection to the external email server.Acceptance criteria:
The Security Server supports sending notification emails when the ACME certificate renewal process state changes.
The Security Server supports sending notification emails if the process fails and when it's completed successfully.
It's possible to enable/disable of sending notification emails.
It's possible to enable/disable success and failure notifications separately.
By default, both notifications are enabled.
The emails are sent using an external email server - the Security Server acts as a client.
Connection parameters to an external email server are configured in a configuration file (e.g.,
acme.yml
or a separate file).The configuration file is included in the Security Server backup.
The Security Server tries to send notifications only if the required configuration details are present and sending notifications is enabled.
The email address configured in the
acme.yml
configuration file is used as a recipient.Configuration examples and instructions refer to a secure connection between the Security Server and the email server.
The Security Server diagnostics page shows the success and failure notification configuration status (enabled / disabled) and are the connection details present in the configuration file (e.g., configuration complete / incomplete).
The recipient’s email address from
acme.yml
is shown in the diagnostics page.If all the configuration parameters are present, it’s possible to send a test email to the recipient. The diagnostics page shows the result of the send operation (success / failure) to the user. If sending the test email fails, the error message returned by the mail server is shown in the UI.
The documentation is updated (at least the following documents):
https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ig-ss_x-road_v6_security_server_installation_guide.md
2.2.1 Network diagram
https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ig-ss_x-road_v6_security_server_installation_guide_for_rhel.md
2.2.1 Network diagram
https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md
24 Configuring ACME
https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-syspar_x-road_v6_system_parameters.md
https://github.com/nordic-institute/X-Road/blob/develop/doc/Architecture/arc-ss_x-road_security_server_architecture.md
2 Component view, 2.9 Management RESt API, 3. Process View, 3.1 xroad-proxy-ui-api