chore: Reduce certificate lifetime to 14 days, clean up subject/SANs#539
Open
jnschaeffer wants to merge 2 commits into
Open
chore: Reduce certificate lifetime to 14 days, clean up subject/SANs#539jnschaeffer wants to merge 2 commits into
jnschaeffer wants to merge 2 commits into
Conversation
This commit reduces the duration of an issued certificate from 5 years to 14 days, fixes a typo in the subject name, and removes logic that modifies the DNS SANs based on whether the DNS name starts with "db.". Signed-off-by: John Schaeffer <john.schaeffer@supabase.io>
jnschaeffer
force-pushed
the
jns/reduce-cert-lifetime
branch
from
July 7, 2026 20:39
545587d to
40d7b12
Compare
🔬 Go Test Coverage ReportSummary
StatusDetailShow New Coverage |
Verolop
reviewed
Jul 8, 2026
| cn := cluster.Spec.CertCommonName | ||
|
|
||
| // Build the secondary SAN by stripping the "db." prefix if present. | ||
| dnsNames := []any{cn} |
Contributor
There was a problem hiding this comment.
Can you please update certificate_test.go to match this? TestBuildCertificate still expects the stripped secondary SAN (abc123.supabase.red) here, plus the old Delware subject string.
Also, can you confirm that dropping the stripped SAN is safe? The subject spelling fix seems fine, but removing this SAN could break any client still connecting via the non-db. hostname.
This commit updates the certificate tests to match the new certificate subject and SANs. Signed-off-by: John Schaeffer <john.schaeffer@supabase.io>
niconosenzo
reviewed
Jul 14, 2026
| // CertDuration is the certificate duration (5 years), matching non-HA projects. | ||
| CertDuration = "44640h0m0s" | ||
| // CertDuration is the certificate duration. | ||
| CertDuration = "336h0m0s" |
Contributor
There was a problem hiding this comment.
Wondering if we should separate the constructors or use different duration for, e.g., external facing certificates (multigateway) and component-to-component certificates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR reduces the duration of an issued certificate from 5 years to 14 days, fixes a typo in the subject name, and removes logic that modifies the DNS SANs based on whether the DNS name starts with "db.".