TLS certificate management

Table of Contents

• ais tls command
• Cert alerts
• Show TLS certificate
• Load TLS certificate

HTTPS deployment implies (and requires) that each AIS node has a valid TLS (a.k.a. X.509) certificate.

The latter has a number of interesting properties ultimately intended to authenticate clients (users) to servers (AIS nodes). And vice versa.

In addition, TLS certificates tend to expire from time to time. In fact, each TLS certificate has expiration date with the standard-defined maximum being 13 months (397 days).

Some sources claim 398 days but the (much) larger point remains: TLS certificates do expire. Which means, they must be periodically updated and timely reloaded.

Starting v3.24, AIStore:

• tracks certificate expiration times;
• automatically - upon update - reloads updated certificates;
• raises associated alerts.

ais tls command

1
$ ais tls --help
2
NAME:
3
   ais tls - load or reload (an updated) TLS certificate; display information about currently deployed certificates
4
5
USAGE:
6
   ais tls command [arguments...] [command options]
7
8
COMMANDS:
9
   show                   show TLS certificate's version, issuer's common name, and from/to validity bounds
10
   load-certificate       load TLS certificate
11
   validate-certificates  check that all TLS certificates are identical
12
13
OPTIONS:
14
   --help, -h  show help

Cert alerts

Associated alerts are listed below but first - an example:

1
$ ais show cluster
2
3
PROXY            MEM AVAIL  LOAD AVERAGE    UPTIME      STATUS  ALERT
4
p[KKFpNjqo][P]   127.77GiB  [5.2 7.2 3.1]   108h30m40s  online  **tls-cert-will-soon-expire**
5
...
6
7
TARGET           MEM AVAIL  CAP USED(%)     CAP AVAIL   LOAD AVERAGE    UPTIME      STATUS  ALERT
8
t[pDztYhhb]      98.02GiB   16%             960.824GiB  [9.1 13.4 8.3]  108h30m1s  online  **tls-cert-will-soon-expire**
9
...
10
...

Overall, there are currently 3 (three) related alerts:

Show TLS certificate

The command has an optional NODE argument - press <TAB-TAB> to select.

Otherwise, simply run:

1
$ ais show tls
2
3
PROPERTY                 VALUE
4
public-key-algorithm     RSA
5
serial-number            55543812950694702162300597243874591179118407338
6
signature-algorithm      SHA256-RSA
7
valid                    from 2024-08-26 18:18:12 to 2025-08-26 18:18:12
8
version                  3
9
issued-by (CN)           localhost

Load TLS certificate

By default, all nodes in the cluster with (unconditionlly) reload X.509 certificates from the respective configured locations:

1
$ ais tls load-certificate
2
3
Done: all nodes.

But you can also choose any specific node, and ask it to reload. See ais tls load-certificate --help for details.

If aistore is deployed with aithentication (enabled), reloading certificates will require administrative permissions.

See ais config cluster command and related auth.enabled knob.

Further references

• Generating self-signed certificates
• Deploying: 4 targets, 1 gateway, 6 mountpaths, AWS backend
• Accessing HTTPS-based cluster
• Testing with self-signed certificates
• Observability: TLS related alerts
• Updating and reloading X.509 certificates
• Switching cluster between HTTP and HTTPS