juju/juju — pull request #1241 by wallyworld (2014-12-01 09:47:21+00:00)
Title: Regenerate state server certificate to update SAN attribute with machine IP addresses

Fixes: https://bugs.launchpad.net/juju-core/+bug/1397909

A new worker listens to address changes of the state server and regenerates the state server certificate to add the addresses to the SAN list. Then the apiserver is restarted to use the new certificate.

To make this possible, the CA cert private key needs to be available.It is discarded at the moment during cloud init. So now it is included in the StateServingInfo and written to agent conf along with other secrets.

Older juju deployments which are upgraded will not have the CA cert private key available, so the state server certificate cannot be regenerated. An upgrade step will need to be written to create a new CA cert for the environment and ensure the private key is recorded.