puppetlabs/puppet

Add clientcert expiration date as core fact.

Open

#9361 opened on May 22, 2024

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Ruby (7,854 stars) (2,214 forks)batch import
enhancementhelp wanted

Description

Use Case

Would be nice to see when clientcerts expire so we know when they need to be rotated, especially when using an external cert provider.

Describe the Solution You Would Like

Add expiration_date to the trusted fact hash

Describe Alternatives You've Considered

Build custom facts, however, the cert name is not available during the custom fact generation in order to get the cert file.

Additional Context

Add any other context or screenshots about the feature request here.

Contributor guide

Tech stack
ruby
Domain
securityinfrastructurebackend
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Basic knowledge of Puppet factsUnderstanding of SSL/TLS certificatesRuby programming basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
45
Research direction
The issue requests adding an expiration date field to the trusted fact hash. This likely involves modifying the code that generates trusted facts, possibly in lib/puppet/facter/trusted.rb or similar files. The contributor should review how existing trusted facts are collected and understand the client certificate data structure to extract the expiration date. The two comments on the issue may provide additional context or questions from maintainers.