cloudtaser-cli source rotate-certs

Regenerates the port mTLS certificate set (CA + broker + client, ECDSA P-256) for one or all registered clusters and pushes the new certs to vault. Writes are sequential. Port reload requires an enabled certificate watcher (default 30s), or a supported managed rebootstrap after an offline maintenance window. Clearing initialized does not force a running operator to fetch new credentials. Restart operators through managed enrollment and verify every listener and consumer. Exposed init salts and enrollment tokens require separate offline maintenance.

Use --fingerprint to rotate certs for a single cluster, or --all to rotate for every registered cluster.

--all is sequential and stops on the first unreadable registration marker; earlier clusters may already have rotated. Inspect per-cluster results before retry.

This is Phase 1 of certificate revocation — immediate rotation without CRL/OCSP. Phase 2 will add short-lived certs or CRL checking.

Usage

cloudtaser-cli source rotate-certs [flags]

Examples

# Rotate certs for a single cluster.
  cloudtaser-cli source rotate-certs \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23

  # Rotate certs for all registered clusters (e.g. compromised CA).
  cloudtaser-cli source rotate-certs --all --yes

  # Against a remote vault with TLS.
  cloudtaser-cli source rotate-certs \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --secretstore-address https://vault.eu.example.com \
    --vault-token-file /etc/cloudtaser/admin.token

Flags

Flag	Type	Default	Required	Description
--all	bool	false	no	rotate certs for all registered clusters
--fingerprint	string	(empty)	no	cluster fingerprint to rotate certs for
--help, -h	bool	false	no	help for rotate-certs
--secretstore-address	string	http://127.0.0.1:8200	no	secret store address (defaults to http://127.0.0.1:8200 — the local OpenBao systemd service on the secretstore VM; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--yes, -y	bool	false	no	assume yes on interactive prompts (required for non-interactive --all)

All commands