CMK-25340 - 18988 Automatic certificate rotation for "Authority Key Identifier" compliance

With the release of Checkmk 2.5, we have introduced an automatic update that seamlessly rotates the site certificate.

The update action checks whether the existing site certificate has the "Authority Key Identifier" property (that was introduced with Werk 18990).
If the property is missing, the script automatically rotates (regenerates) the certificate. This ensures that, after the update, all certificates are compliant with the new standard.

No user action is required during the update process.
If a certificate already has the AKI property, no changes are made.

Additionally, the underlying certificate creation libraries have been updated. Any certificate manually created or rotated in the future (e.g., via the cmk-cert tool) will include the Authority Key Identifier by default.

Change-Id: I84efeef694963ae0ec702b50aab7e5e738a8973d

Author: Salvatore Nitopi

.werks/18988.md

@@ -0,0 +1,22 @@
+[//]: # (werk v2)
+# Automatic certificate rotation for "Authority Key Identifier" compliance
+
+key        | value
+---------- | ---
+date       | 2025-12-17T15:30:42+00:00
+version    | 2.5.0b1
+class      | feature
+edition    | cre
+component  | core
+level      | 1
+compatible | yes
+
+With the release of Checkmk 2.5, we have introduced an automatic update that seamlessly rotates the site certificate.
+
+The update action checks whether the existing site certificate has the "Authority Key Identifier" property (that was introduced with Werk 18990).
+If the property is missing, the script automatically rotates (regenerates) the certificate. This ensures that, after the update, all certificates are compliant with the new standard.
+
+No user action is required during the update process.
+If a certificate already has the AKI property, no changes are made.
+
+Additionally, the underlying certificate creation libraries have been updated. Any certificate manually created or rotated in the future (e.g., via the cmk-cert tool) will include the Authority Key Identifier by default.