
title: 'Ensure that the default Ingress certificate has been replaced'

description: |-
  Check that the default Ingress certificate has been replaced.

rationale: |-
  OpenShift auto-generates several PKIs to serve TLS on different
  endpoints of the system. It is possible and necessary to configure a
  custom PKI which allows external clients to trust the endpoints.

  The Ingress Operator is the component responsible for enabling external
  access to OpenShift Container Platform cluster services. The aforementioned
  operator creates an internal CA and issues a wildcard certificate that is
  valid for applications under the .apps sub-domain. Both the web console
  and CLI use this certificate as well. The certificate and key would need
  to be replaced since a certificate coming from a trusted provider is
  needed.

  {{{ weblink(link="https://docs.openshift.com/container-platform/latest/security/certificates/replacing-default-ingress-certificate.html") }}}

severity: medium

references:
  nist: SC-12

ocil_clause: 'Ingress Operator default certificate needs to be replaced'

ocil: |-
  Verify that the ingresscontroller.operator/default resource contains the name of a certificate secret:
    <tt>oc get ingresscontroller.operator/default -n openshift-ingress-operator -ojsonpath='{ .spec."defaultCertificate"."name" }'</tt>
  The result should be the name of a valid secret. If none, the default Ingress certificate is in use.

warnings:
- general: |-
    {{{ openshift_cluster_setting("/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default") | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: /apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default
    yamlpath: ".spec.defaultCertificate.name"
    check_existence_yamlpath: ".metadata.name"
    values:
    - value: ".+"
      operation: "pattern match"
