Update the description for the tls_ca_cert config option to use openssl rehash instead of c_rehash

[FlorentClarret]

What does this PR do?

Update the description for the tls_ca_cert config option to use openssl rehash instead of c_rehash

Motivation

c_rehash has a CVE and we should discourage people from using it: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-1292

We will most likely remove this script from the Agent

Additional Notes

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Changelog entries must be created for modifications to shipped code
• Add the qa/skip-qa label if the PR doesn't need to be tested during QA.

[clamoriniere]

Hi @FlorentClarret

The changes look good for @DataDog/container-integrations files.

Quick question to be sure that it was evaluated: Are we sure that this change is backward compatible with certificates already used with our integrations with success? Can we expect that some user configuration might fail after the agent update?

[FlorentClarret]

Hi @FlorentClarret

The changes look good for @DataDog/container-integrations files.

Quick question to be sure that it was evaluated: Are we sure that this change is backward compatible with certificates already used with our integrations with success? Can we expect that some user configuration might fail after the agent update?

That's a good question indeed!

Both commands c_rehash and openssl rehash are functionally equivalent except that, by default, openssl rehash only generates SHA-1 files. Old-style hashes use MD5 and can be generated with either the -old option or using the -compat option which will generate both MD5 and SHA-1 files. MD5s are used with pre-1.0.0 versions of openssl which we do not use so I don't think customers will need to generate them since Agent 6 is (currently) shipped with 1.1.1u and Agent 7 with 3.0.12. Also here this is a doc change, we do not modify anything else so simply updating the Agent can't break them.

Let me know if I missed something, or if I should add more info in the docs!