opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-11-03 16:38:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: add note about user CA rotation + desktop access

Browse Source 
In the future we'll move desktop access to a separate CA, but for
now Windows certs are generated with the user CA, so Active Directory
will need to be updated to trust the new certificate when a rotation
takes place.
This commit is contained in:
Zac Bergquist
2022-03-30 13:57:27 -06:00
committed by Zac Bergquist
parent f0bfe78999
commit f7fc4615ed
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pages/desktop-access/getting-started.mdx
+7 -4
View File
@@ -148,12 +148,15 @@ certificate-based smart card authentication, and ensuring RDP is enabled.
### Export the Teleport CA
<Admonition type="note" title="Requires Existing Cluster">
The following step requires an existing cluster. If you don't already have a
Teleport cluster up and running, see our general [Getting
Started](../getting-started.mdx) guide.
The following step requires an existing cluster. If you don't already have a
Teleport cluster up and running, see our general [Getting
Started](../getting-started.mdx) guide.
<Admonition type="note" title="User CA Rotation">
These steps will need to be repeated if Teleport's user certificate authority is rotated.
</Admonition>
1. Get the Teleport user CA certificate by running:
```code
docs/pages/setup/operations/ca-rotation.mdx
+10 -5
View File
@@ -61,11 +61,16 @@ the [customer portal](https://dashboard.gravitational.com/web/login).
This section will show you how to implement certificate rotation in practice.
<Admonition type="warning" title="CA Pinning Warning">
If you are using [CA
Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new
nodes, the CA pin will change after the rotation. Make sure you use the *new*
CA pin when adding nodes after rotation.
If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers)
when adding new nodes, the CA pin will change after the rotation. Make sure you
use the *new* CA pin when adding nodes after rotation.
<Admonition type="warning" title="Desktop Access">
Teleport signs Windows Desktop certificates with the user certificate authority.
If the user CA is rotated, the new CA certificate will need to be exported and
configured in group policy.
[Read more about exporting the Teleport CA](../../desktop-access/getting-started.mdx#export-the-teleport-ca)
</Admonition>
### Rotation phases