Initial setup

  • DNS checks fail if you do a permanent network setup without doing a temporary config first.
  • GUI password as set in the setup doesn't work. Resetting the password through the cli to the same things as setup initially makes it work.

First run

  • Initial log in goes to a "not authorized" page, which then redirects to a log out page... which does nothing. Manually going to the cluster domain again redirects to the main COP page... logged in.

Uploading a certificate

  • I have yet to be successful in uploading a PEM. Things attempted:
    • Uploading a fully cat-ed chain (i.e., leaf, key, and intermediate)
    • Uploading the root and intermediate certs explicitly as a CA, then uploading the leaf/key PEM.
  • When uploading a PEM fails, the entire HTTP process dies, and the only way to recover is to rebuild COP (or probably TAC intervention).
  • SANs are not checked when uploading a certificate. A typo here can take the whole server down.
  • Uploading a second CA cert seems to override the first.
  • What does work is uploading a PKCS12, which contains the server cert, key, and intermediate cert(s). Although, this still throws an error message. PKCS12 false error

Missing features

  • There is no way to upload the certificate from the cli.
  • There is no way to upload a server certificate without applying it. This makes it impossible to stage a change.