feat(kmip): kmip auto cert renewal - #7542
Conversation
KMIP servers now auto-renew their TLS certificates (see infisical-kmip). /kmip/servers/connect accepts an isRenewal query flag recorded in the register-kmip-server audit metadata so renewals are distinguishable from first-time connects. Certificate TTL becomes optional in the deploy and edit modals (server default 1y), and the stale restart-to-apply copy and docs now describe renewal semantics.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
💬 Discussion in Slack: #pr-review-infisical-7542-feat-kmip-renewal-audit-flag-optional-certificate-ttl-d Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3fb98017c0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 2 · PR risk: 0/10 |
|
| Filename | Overview |
|---|---|
| backend/src/ee/routes/v1/kmip-server-router.ts | Adds validated renewal audit metadata and retains the existing one-year fallback for certificate issuance. |
| backend/src/ee/services/audit-log/audit-log-types.ts | Extends KMIP registration audit metadata with an optional renewal marker. |
| frontend/src/pages/organization/KmipServersPage/KmipServerDetailsByIDPage/components/KmipServerCertConfig/KmipServerCertConfigModal.tsx | Makes TTL blankable, but clearing an existing custom value silently preserves it instead of resetting to the default. |
| frontend/src/pages/organization/KmipServersPage/components/components/KmipServerDeployModal.tsx | Omits blank TTL values during creation, allowing the backend create schema to apply its one-year default. |
| docs/documentation/platform/kms/kmip.mdx | Documents optional TTLs, automatic renewal scheduling, retries, and revoked-access recovery. |
| docs/cli/commands/kmip.mdx | Updates CLI guidance to describe automatic renewal and when configuration changes take effect. |
Reviews (1): Last reviewed commit: "feat(kmip): audit flag for certificate r..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
PATCH /kmip/servers/:id now accepts ttl: null to clear a stored custom TTL, and the edit modal sends null when the field is blanked, so renewals fall back to the 1y default instead of silently keeping the old value.
bernie-g
changed the title
With auto-renewal the TTL is an internal detail, matching how gateway certificates work (hardcoded lifetime, no UI knob). Servers get the 1y default; a custom ttl can still be set via the API. Also guard the ttl validator against ms() throwing on unparseable input like an empty string, which previously surfaced a broken 400.
/connect now logs its own kmip-server-connect event instead of reusing register-kmip-server with a client-reported isRenewal flag; the flag, its query param, and the metadata field are removed. Docs trimmed to a Renewal Failures troubleshooting section since the happy path needs no explanation.
ms() reads "1m" as one minute, the natural typo for one month, which would leave the server reissuing its certificate every minute forever. Reject sub-hour TTLs with a message naming the floor.
The 1 hour floor was only enforced on input, so a server configured before it existed keeps its old value. The daemon would then be handed a certificate it spends the rest of its life reissuing, which is exactly the "1m" case the floor was added for. Check the resolved TTL in the connect handler too, and name the offending value so the operator knows what to change.
The floor was checked per route, which missed the legacy registration path: it validated only ms(val) > 0, so "1m" reached certificate issuance there even after the enrollment path was fixed. Move the check into registerServer, which both callers go through, and raise the legacy route's own validation to the same floor. Reject rather than clamp. Silently raising the value leaves the stored config wrong and the operator never learns the certificate they get is not the one they asked for. Also handle unparseable input: ms() returns undefined rather than throwing, and NaN comparisons are always false, so garbage previously slipped past the floor and failed later as a 500.
…o-renewal-of-kmip-server-certificates
Keeps why the TTL check throws instead of clamping, that ms() returns undefined rather than throwing, and why the floor sits at issuance. Drops the surrounding restatement of the code.
3 participants
Context
KMIP servers now auto-renew their TLS certificates (Infisical/infisical-kmip#14, Infisical/cli#354): this adds an
isRenewalflag to theregister-kmip-serveraudit log, makes Certificate TTL optional in the UI, and updates the docs accordingly. Tested E2E locally.Type