Add docs for 38002 - FLEET_MDM_CERTIFICATE_PROFILES_LIMIT#38028
Add docs for 38002 - FLEET_MDM_CERTIFICATE_PROFILES_LIMIT#38028rachaelshaw merged 4 commits intodocs-v4.83.0from
Conversation
JordanMontgomery
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
JordanMontgomery
changed the title
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
JordanMontgomery
had a problem deploying
to
Docker Hub
GitHub Actions
Error
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
JordanMontgomery
had a problem deploying
to
Docker Hub
GitHub Actions
Error
Updated environment variable name for certificate profiles limit in documentation.
JordanMontgomery
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
JordanMontgomery
changed the title
|
|
||
| The profile reconciler runs approximately every 30 seconds. The best practice is to set this at a level that is half or less the number that can be handled by your certificate authority in one minute. If a profile for instance is uploaded that references a SCEP server which can handle 100 transactions per minute, best practice would be to set this to 50 or less. Lower values will mean that a profile potentially takes longer to be sent to all hosts targeted by it, with a tradeoff that it will result in lower Certificate Authority load. | ||
|
|
||
| For a team with 10,000 hosts targeted by a newly-uploaded profile containing Certificate Authority variables, a setting of 100 would mean that it would take 100 runs of the profile reconciler, or, at least 50 minutes, for all 10,000 certificate profiles to be sent. |
There was a problem hiding this comment.
@noahtalerman @marko-lisica Rate limits for various CAs:
Digicert: https://dev.digicert.com/en/certcentral-apis/services-api/rate-limits.html Digicert One doesn't have any documentation around Ratelimits that I can find but CertCentral says 100/5 seconds, 1000/3 minutes. We should stay below these limits with the default of 100
Smallstep: Could not find
Hydrant(Not supported in macOS profiles yet): Nothing publicly available
NDES: No fixed limit, based on your config
SCEP: Too many SCEP servers out there to really give an answer, depends on customer config
Given the above do we need to document them since we're having trouble finding published numbers to link to?
There was a problem hiding this comment.
Welp...thanks for checking!
Given the above do we need to document them since we're having trouble finding published numbers to link to?
Jordan, up to you. I think it makes sense to not document since we don't have the numbers.
There was a problem hiding this comment.
Yeah I think if we stick with our current default and refer admins to their CAs for additional guidance we should be good. The CA vendors may have more guidance only available to paying subscribers or via support channels as well
4 participants
Related issue: Docs example for #38002
Should not be merged yet as this is not targeted for a specific release branch