From f7fc4615ed9d7a4e98936bb4a516c2aa1dfd4d49 Mon Sep 17 00:00:00 2001 From: Zac Bergquist Date: Mon, 28 Mar 2022 13:59:53 -0600 Subject: [PATCH] docs: add note about user CA rotation + desktop access In the future we'll move desktop access to a separate CA, but for now Windows certs are generated with the user CA, so Active Directory will need to be updated to trust the new certificate when a rotation takes place. --- docs/pages/desktop-access/getting-started.mdx | 11 +++++++---- docs/pages/setup/operations/ca-rotation.mdx | 15 ++++++++++----- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/pages/desktop-access/getting-started.mdx b/docs/pages/desktop-access/getting-started.mdx index 351b57654dc..6ab595b2e22 100644 --- a/docs/pages/desktop-access/getting-started.mdx +++ b/docs/pages/desktop-access/getting-started.mdx @@ -148,12 +148,15 @@ certificate-based smart card authentication, and ensuring RDP is enabled. ### Export the Teleport CA - - The following step requires an existing cluster. If you don't already have a - Teleport cluster up and running, see our general [Getting - Started](../getting-started.mdx) guide. +The following step requires an existing cluster. If you don't already have a +Teleport cluster up and running, see our general [Getting +Started](../getting-started.mdx) guide. + + +These steps will need to be repeated if Teleport's user certificate authority is rotated. + 1. Get the Teleport user CA certificate by running: ```code diff --git a/docs/pages/setup/operations/ca-rotation.mdx b/docs/pages/setup/operations/ca-rotation.mdx index dfeabee9a23..7f9a8424108 100644 --- a/docs/pages/setup/operations/ca-rotation.mdx +++ b/docs/pages/setup/operations/ca-rotation.mdx @@ -61,11 +61,16 @@ the [customer portal](https://dashboard.gravitational.com/web/login). This section will show you how to implement certificate rotation in practice. - - If you are using [CA - Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new - nodes, the CA pin will change after the rotation. Make sure you use the *new* - CA pin when adding nodes after rotation. +If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) +when adding new nodes, the CA pin will change after the rotation. Make sure you +use the *new* CA pin when adding nodes after rotation. + + +Teleport signs Windows Desktop certificates with the user certificate authority. +If the user CA is rotated, the new CA certificate will need to be exported and +configured in group policy. + +[Read more about exporting the Teleport CA](../../desktop-access/getting-started.mdx#export-the-teleport-ca) ### Rotation phases