strimzi-kafka-operator icon indicating copy to clipboard operation
strimzi-kafka-operator copied to clipboard

Remove the `openssl` usage for PKI administrative operations

Open ppatierno opened this issue 7 months ago • 4 comments

By merging https://github.com/strimzi/strimzi-kafka-operator/pull/11224, the OpenSslCertManager class is now a mix of openssl usage and Java security framework but openssl is used only for administrative operations (i.e. generating CA and EE certificates).

In order to remove the usage of openssl within the operator we should refactor the OpenSslCertManager class (maybe also renaming it) regarding all the administrative certificates operations. It means the following methods should use the Java security framework to do the same without openssl:

  • generateCaCert which is about generating a self-signed CA certificate
  • generateCsr which is about generating a CSR to sign a certificate
  • generateCert which is about generating a certificate starting from a CSR

The above should take into account the createDefaultConfig method as well which is setting up an openssl configuration from the openssl.conf file to setting up a PKI for the administrative operations.

ppatierno avatar Mar 26 '25 02:03 ppatierno