Email from Let's Encrypt about urgent revocation

Hi @rcampbell22. Thanks for reaching out!

Unfortunately the latest version of the SCIM bridge v2.3.0 (build 203004) will not be able to automatically renew the certificate. We have already applied a fix to the SCIM bridge to allow for auto-renewal in scenarios like this in future, but this fix will only be available in the next release of the SCIM bridge.

For now you can force a renewal of the SCIM bridge by clearing the redis cache and restarting the SCIM bridge. The SCIM bridge caches the Lets Encrypt certificate in redis, and attempts to obtain a new certificate on startup when no certificate is available in the cache.

Note before you continue to the steps below: The tradeoff is that you will also lose the SCIM bridge logs for the last 3 days. If you'd like to keep the logs you can log into the SCIM bridge status page by navigating to your SCIM bridge URL and entering your Bearer Token, and downloading the log files shown at the bottom of the status page.

The steps to clear the redis cache and restart the SCIM bridge:
1. Open a terminal where you have access to the Kubernetes command line interface (kubectl), and make sure you are connected to the cluster running your SCIM bridge
2. Scale down the SCIM bridge instance in your cluster: kubectl scale --replicas=0 deployment/<scim-bridge-deployment-name>
3. Scale down the redis instance in your cluster: kubectl scale --replicas=0 deployment/<redis-deployment-name>
4. Wait a few seconds for the Kubernetes scheduler to remove the running redis and SCIM bridge instance
5. Scale up the redis instance in your cluster: kubectl scale --replicas=1 deployment/<redis-deployment-name>
6. Scale up the SCIM bridge instance in your cluster: kubectl scale --replicas=1 deployment/<scim-bridge-deployment-name>

You may need to specify the namespace for your SCIM bridge and redis deployment. You can get the namespace for these by issuing the kubectl get deployment --all-namespaces command. You can then include the namespace in the above commands by adding the --namespace=<deployment-namespace> flag.

The SCIM bridge will attempt to get a new certificate from Let's Encrypt when it starts up. You may experience a couple of minutes of downtime while you scale down/up the SCIM bridge and redis instances in your cluster. Feel free to pause provisioning in your identity provider while you perform the steps to force a certificate renewal.

Please feel free to reach out to our support team via our https://support.1password.com if you need specific guidance for your deployment.

That's great. It fixed the issue - albeit unfortunately it had already revoked by the time I saw this but no major impact! :) Good to know it will be resolved in next version.

Thanks,
Richard

Glad to hear it! Let us know if there's anything else we can assist you with.