From 46bafd6edad2be5ca4ff490ef3068bba52d4366f Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 26 May 2026 13:17:10 +0300
Subject: [PATCH] feat(redis): add digital signature to leaf cert usages for
 ECDSA TLS handshake

TLS_ECDHE_ECDSA cipher suites require the server certificate to assert the
digital signature key usage so the server can sign ephemeral key-exchange
parameters. Without it, strict TLS clients reject the handshake even though
the cert is otherwise valid. Added the usage to the leaf Certificate and
extended the helm-unittest suite to cover it.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../apps/redis/templates/certmanager.yaml     |  1 +
 packages/apps/redis/tests/tls_test.yaml       | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/packages/apps/redis/templates/certmanager.yaml b/packages/apps/redis/templates/certmanager.yaml
index d7c7d7e82..6d104e667 100644
--- a/packages/apps/redis/templates/certmanager.yaml
+++ b/packages/apps/redis/templates/certmanager.yaml
@@ -69,6 +69,7 @@ spec:
   renewBefore: 720h
   isCA: false
   usages:
+    - digital signature
     - server auth
     - client auth
     - key encipherment
diff --git a/packages/apps/redis/tests/tls_test.yaml b/packages/apps/redis/tests/tls_test.yaml
index 56093277a..c82dab29e 100644
--- a/packages/apps/redis/tests/tls_test.yaml
+++ b/packages/apps/redis/tests/tls_test.yaml
@@ -125,6 +125,9 @@ tests:
       - equal:
           path: spec.privateKey.algorithm
           value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
 
   - it: "third document is the CA Issuer when TLS enabled via external"
     templates:
@@ -175,6 +178,26 @@ tests:
           path: spec.privateKey.algorithm
           value: ECDSA
 
+  - it: "leaf Certificate usages include digital signature for ECDSA TLS handshake"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      external: true
+    documentIndex: 3
+    asserts:
+      - contains:
+          path: spec.usages
+          content: "digital signature"
+      - contains:
+          path: spec.usages
+          content: "server auth"
+      - contains:
+          path: spec.usages
+          content: "client auth"
+      - contains:
+          path: spec.usages
+          content: "key encipherment"
+
   - it: "leaf Certificate SAN list covers all four redis-operator service names with all DNS variants"
     templates:
       - templates/certmanager.yaml