Moving from Shared Wildcard Certificates to OpenShift Service CA for Internal TLS

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

The Identity Security Platform Authentication Hub currently uses a single, shared wildcard certificate bundled in Kubernetes Opaque secrets to establish internal Transport Layer Security (TLS) among its 15+ microservices. While functional, this architectural design requires manual certificate rotation, mandates security exceptions due to the inherent risks of wildcard certificates in shared clusters, and increases administrative overhead.

Environment

Symantec Identity Security Platform 4.0 (SSP / Authentication Hub)

Resolution

This requirement has been classified as an Enhancement Request (Feature Request) for the Symantec Identity Security Platform.

• Status: Tracked for a future product release.

• Workaround: Until the enhancement is integrated into the core product Helm charts, administrators must continue to manually manage, rotate, and apply security exceptions for the Opaque wildcard certificates.