Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v9] Backport "docs: add note about user CA rotation + desktop access" (#10126) #11586

Merged
merged 2 commits into from
Apr 1, 2022
Merged

[v9] Backport "docs: add note about user CA rotation + desktop access" (#10126) #11586

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1991059
docs: add note about user CA rotation + desktop access
zmb3 Mar 28, 2022
c19f9c3
Merge branch 'branch/v9' into v9-backport-10126
zmb3 Apr 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions docs/pages/desktop-access/getting-started.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,12 +148,15 @@ certificate-based smart card authentication, and ensuring RDP is enabled.

### Export the Teleport CA

<Admonition type="note" title="Requires Existing Cluster">
The following step requires an existing cluster. If you don't already have a
Teleport cluster up and running, see our general [Getting
Started](../getting-started.mdx) guide.
The following step requires an existing cluster. If you don't already have a
Teleport cluster up and running, see our general [Getting
Started](../getting-started.mdx) guide.

<Admonition type="note" title="User CA Rotation">
These steps will need to be repeated if Teleport's user certificate authority is rotated.
</Admonition>


1. Get the Teleport user CA certificate by running:

```code
Expand Down
15 changes: 10 additions & 5 deletions docs/pages/setup/operations/ca-rotation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,16 @@ description: How to rotate Teleport's certificate authority

This section will show you how to implement certificate rotation in practice.

<Admonition type="warning" title="CA Pinning Warning">
If you are using [CA
Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers) when adding new
nodes, the CA pin will change after the rotation. Make sure you use the *new*
CA pin when adding nodes after rotation.
If you are using [CA Pinning](../admin/adding-nodes.mdx#untrusted-auth-servers)
when adding new nodes, the CA pin will change after the rotation. Make sure you
use the *new* CA pin when adding nodes after rotation.

<Admonition type="warning" title="Desktop Access">
Teleport signs Windows Desktop certificates with the user certificate authority.
If the user CA is rotated, the new CA certificate will need to be exported and
configured in group policy.

[Read more about exporting the Teleport CA](../../desktop-access/getting-started.mdx#export-the-teleport-ca)
</Admonition>

### Rotation phases
Expand Down