Feature Request: support updating alt-names

[natemccurdy]

Currently, if you change the list of alt names in a certificate, the provider doesn't update the cert (or destroy and recreate it).

Not exactly sure how that'd work though.... can certs have their alt-names changed without being destroyed and recreated?

[reidmv]

This is a valid request, but difficult to meaningfully implement. dns_alt_names in a cert can't be changed - a new cert would have to be issued.

The Puppet CA will throw away CSRs for a common name that already exists and hasn't been revoked. Currently, there is no way for a node to:

• Request revocation for its own cert
• Request an updated cert for its own common name

Until a mechanism exists for something like that, there's not much we can do on this end.

What we COULD do would be to make noise if the existing cert's dns_alt_names don't match the desired dns_alt_names. That would be the approach to take today when/if someone starts working on this issue. A bigger picture fix would require new certificate-management features in Puppet.