Document TLS certificate rotation for the installer - #1510
Document TLS certificate rotation for the installer#1510darrell-thobe-netwrix wants to merge 11 commits into
Conversation
GitHub Actions
Error
Add update-cert and rollback-cert to the installer reference (flags, exit codes) and a new task page walking through rotating an expiring or untrusted certificate without reinstalling.
8b935e0 to
4443e98
Compare
GitHub Actions
Error
Auto-Fix Summary5 issues fixed, 8 skipped across 3 files
| Ask |
Fix the exit-code cross-reference and its accuracy around --no-rollback and unreachable ingresses, add a maintenance-window note and a reverse-proxy pointer before the procedure, name the dspm-tls Secret, document the --hostname override, use placeholder hostnames in the verification command, align exit-code and heading style with the rest of the reference, and fix sidebar ordering between the post-install task pages and the installer reference.
GitHub Actions
Error
Auto-Fix Summary0 issues fixed, 6 skipped across 3 files
| Ask |
Fix a dropped relative pronoun, qualify the rollback claim against --no-rollback and unreachable-ingress cases, align boolean flag defaults and the rollback-cert exit codes with the rest of the reference, cross-link the two docs for exit codes and cleanup steps, define platform-service and trust anchor on first use, clarify that the rotation timeout is a configurable default, and spell out what a healthy CA bundle check looks like.
GitHub Actions
Error
Auto-Fix Summary2 issues fixed, 15 skipped across 3 files
| Detailsblock that has no heading of its own. || docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md:83 — Dale: positional-references | 'under Check the Result' is a structural reference backed by a named anchor, which the rule explicitly permits, rather than a bare 'below' or 'above'. || docs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md:168 — Dale: passive-voice | 'caBundle is already base64-encoded' describes a state of the stored value; naming an actor would misstate which component performed the encoding. || docs/accessanalyzer/26.1/install/installer-reference.md:22 — Dale: xy-slop | '--hostname reads DSPM_HOSTNAME, not HOSTNAME' is positive-first disambiguation between two similar variable names, not the negative-then-positive pattern the rule targets; the negation is the point of the sentence. || docs/accessanalyzer/26.1/install/installer-reference.md:46 — Dale: passive-voice | 'must both be provided together' sits inside a backticked verbatim error string; changing it would misquote the installer's output. || docs/accessanalyzer/26.1/install/installer-reference.md:133 — Dale: passive-voice | 'at least 40 GB is needed to install' sits inside a backticked verbatim preflight message; changing it would misquote the installer's output. || docs/accessanalyzer/26.1/install/installer-reference.md:134 — Dale: passive-voice | 'the size is designed to hold GB' sits inside a backticked verbatim preflight message; changing it would misquote the installer's output. || docs/accessanalyzer/26.1/install/installer-reference.md:137 — Dale: passive-voice | 'installation may not be supported' sits inside a backticked verbatim preflight message; changing it would misquote the installer's output. || docs/accessanalyzer/26.1/install/installer-reference.md:84 — Dale: passive-voice | 'must not be expired' is an adjectival state of the certificate rather than passive voice, and matches the parallel phrasing used across the value-checks table. || docs/accessanalyzer/26.1/install/index.md:6 — Dale: minimizing-difficulty | 'answer a few prompts' states the actual scope of the interactive install rather than characterizing the task as easy; the page makes no claim about difficulty. || docs/accessanalyzer/26.1/install/index.md:26 — Dale: wordiness | 'for when you script an installation or need to find out why one stopped' reads awkwardly, but the two use cases it names are distinct and any tightening either drops one or changes the sentence into a second imperative, altering the author's framing. |
Ask |
Verified against the actual implementation (netwrix-corp/access-analyzer commit d2ef453). rollback-cert has no exit code 72 — its real codes are 0, 1, 73, and 74. It also accepts --hostname, --port, --timeout, --kubeconfig, and --argocd-namespace like update-cert does; only --list, --latest, and --snapshot were documented. Also note that update-cert's exit code 72 is reused for --no-rollback runs and for a snapshot that couldn't be loaded, not only a successful rollback.
GitHub Actions
Error
Auto-Fix Summary3 issues fixed, 6 skipped across 3 files
| Ask |
Add --log-path (env LOG_PATH, default /var/log/dspm-installer.log) to the flags table and update the Logs section to describe its fatal-vs- fallback write-failure behavior: unwritable at the default path falls back to stderr, but the same failure on an explicitly set path stops the installer.
GitHub Actions
Error
Auto-Fix Summary1 issues fixed, 13 skipped across 3 files
| Ask |
| sudo dspm-installer rollback-cert --latest | ||
|
|
||
| # or a specific one | ||
| sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/2026-09-08T14-02-11Z |
There was a problem hiding this comment.
| sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/2026-09-08T14-02-11Z | |
| sudo dspm-installer rollback-cert --snapshot /etc/dspm/cert-snapshots/<snapshot date> |
There was a problem hiding this comment.
Went with <timestamp> instead of <snapshot date> since that's already the placeholder used for this same path elsewhere on the page: the snapshot directory, the cleanup example, and the manual-recovery walkthrough. Keeps it consistent. Fixed in 04553ff.
Per PR feedback, --snapshot examples used a literal timestamp from when the doc was written. Use <timestamp>, matching the placeholder already used for this path elsewhere on the page.
GitHub Actions
Error
Documentation PR ReviewEditorial Reviewdocs/accessanalyzer/26.1/install/rotate-the-tls-certificate.md
docs/accessanalyzer/26.1/install/installer-reference.md
docs/accessanalyzer/26.1/install/index.md
Summary12 editorial suggestions across 3 files. Vale and Dale issues are auto-fixed separately. What to do next: Comment
You can ask Claude anything about the review or about Netwrix writing standards.
|
Auto-Fix Summary1 issues fixed, 13 skipped across 3 files
| Ask |
5 participants
Summary
install/rotate-the-tls-certificate.md, covering theupdate-certandrollback-certsubcommands: when to rotate, staging the certificate/CA bundle, running the rotation, the reverse-proxy caveat, rolling back, and manual recovery ifrollback-certcan't apply.update-certandrollback-certto the installer reference: command synopsis, full flag tables, and exit codes (72–75 forupdate-cert, plusrollback-cert's exit codes).Test plan
valeon all three changed files — 0 errors, 0 warnings/daleon all three changed files — no violationsupdate-cert/rollback-certbehavior against the source engineering doc