Ensure that the default Ingress CA (wildcard issuer) has been replaced
An XCCDF Rule
Description
Check that the default Ingress CA has been replaced.
warning alert: Warning
/apis/config.openshift.io/v1/proxies/cluster API endpoint to the local Rationale
OpenShift auto-generates several PKIs to serve TLS on different endpoints of the system. It is possible and necessary to configure a custom PKI which allows external clients to trust the endpoints. The Ingress Operator is the component responsible for enabling external access to OpenShift Container Platform cluster services. The aforementioned operator creates an internal CA and issues a wildcard certificate that is valid for applications under the .apps sub-domain. Both the web console and CLI use this certificate as well. The certificate and key would need to be replaced since a certificate coming from a trusted provider is needed. https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html
- ID
- xccdf_org.ssgproject.content_rule_default_ingress_ca_replaced
- Severity
- Medium
- References
- Updated