TLS Certificates Interface

Technical Differences between v3 and v4

v3

• requires users to perform multiple TLS-related operations independently
  • generate a private key
  • generate CSR
  • request a certificate
  • listen to certificate expiry events

V4

• Requires secrets! (Juju 3.0+)
• Focused on automating most of the TLS Certificate activities for the charm author.
  • The intent is for the charm developers to focus on what is in their certificates and not how to get them or manage their lifecycle.

Implications

Since v4 automates most of the TLS Certificate activities, in most cases charm authors will be using a private key generated by the charm library.

This means that, without intervention, upon upgrade of the charm the charm will use the private key generated by the charm library which will cause a certificate rotation.

However, should the charm author wish to use a specific private key, and avoid the certificate rotation, they can do so by passing the private key to the TLSCertificatesRequiresV4 class upon instantiation.