Fix: use Let's Encrypt certificates for all affected versions (product-is#28282)

[floze-the-genius]

Purpose

Resolves wso2/product-is#28282.

Replace the expired Comodo trial-certificate guidance in the shared CA-signed certificate include with a current Let's Encrypt/Certbot CSR flow. The update also removes hard-coded Comodo chain filenames and imports the full chain using the original private-key alias.

Affected documentation versions: 7.0.0, 7.1.0, 7.2.0, 7.3.0, and next. All five pages consume the updated shared include.

Related PRs

None.

Test environment

• markdownlint-cli2: passed for the changed include
• Official Certbot and Let's Encrypt links: HTTP 200
• mkdocs build for en/identity-server/next: passed; the rendered page contains the new Certbot/full-chain guidance and no stale Comodo filenames
• Strict MkDocs build reaches the rendered page but reports 26 pre-existing redirect warnings in unchanged documentation
• No images or screenshots changed

Security checks

• Followed secure documentation practices and linked only official certificate-authority/client guidance
• FindSecurityBugs is not applicable to this documentation-only change
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Warning

Review limit reached

@floze-the-genius, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1951b064-cb72-46a6-bd52-2ef7034a6a88

📥 Commits

Reviewing files that changed from the base of the PR and between 3ea3a5c and 0c603cd.

📒 Files selected for processing (1)

• en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md

📝 Walkthrough

Walkthrough

The guide replaces Comodo-specific instructions with a Let’s Encrypt Certbot workflow. It documents manual validation, generated certificate files, intermediate chains, and full-chain certificate-reply import into a Java keystore.

Changes

CA-signed certificate workflow

Layer / File(s)	Summary
Certbot certificate issuance en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md	The guide uses Certbot to submit a CSR to Let’s Encrypt, complete manual validation, and handle the generated certificate files and returned intermediate chain.
Full-chain keystore import en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md	The keystore import uses full-chain.pem with the existing private-key alias. Separately supplied chains are imported in root-to-leaf order.

Suggested labels: Team/Identity Server Core

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the replacement of certificates with Let's Encrypt certificates across affected versions.
Description check	✅ Passed	The description covers the purpose, related PRs, test environment, security checks, affected versions, and linked issue.
Linked Issues check	✅ Passed	The changes satisfy issue #28282 by replacing free-trial certificate guidance with a Let's Encrypt and Certbot flow.
Out of Scope Changes check	✅ Passed	The changes are limited to the shared certificate documentation and directly support the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md (1)

61-61: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Make the separate-chain fallback executable.

Add commands that import the root and intermediate certificates under distinct trusted aliases, then import server-certificate.pem under certalias. The current sentence does not show the required aliases or commands, so users can accidentally reuse the private-key alias for a CA certificate. (docs.oracle.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md`
at line 61, Expand the separate-chain fallback instructions to include
executable keytool commands: import the root and intermediate CA certificates
under distinct trusted aliases, then import server-certificate.pem using the
certalias private-key alias. Ensure the commands preserve root-to-leaf order and
prevent either CA certificate from reusing certalias.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md`:
- Around line 53-58: Remove the hardcoded mypassword value and the -storepass
option from both keytool importcert examples, including the JKS and PKCS12
commands, so keytool prompts for the keystore password instead.
- Around line 25-34: Update the certificate procedure around Step 2 to document
CSR-based renewal using the same Certbot CSR flags and output paths, then import
the renewed full-chain certificate into the Java keystore. Keep all JKS import
commands consistent in keystore type and require interactive password prompting
rather than embedding passwords in commands.
- Around line 53-54: Update every keytool import and export command in the JKS
and PKCS12 blocks to explicitly specify the matching keystore format: add
-storetype JKS to commands in the JKS block and -storetype PKCS12 to commands in
the PKCS12 block, including the command around keytool -importcert.

---

Nitpick comments:
In
`@en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md`:
- Line 61: Expand the separate-chain fallback instructions to include executable
keytool commands: import the root and intermediate CA certificates under
distinct trusted aliases, then import server-certificate.pem using the certalias
private-key alias. Ensure the commands preserve root-to-leaf order and prevent
either CA certificate from reusing certalias.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: e07817c4-d285-468c-8a51-dfe790c012ab

📥 Commits

Reviewing files that changed from the base of the PR and between bd0aa5f and 3ea3a5c.

📒 Files selected for processing (1)

• en/includes/deploy/security/keystores/manage-ca-signed-certificates-in-a-keystore.md

[pavinduLakshan]

I noticed that some parts of the documentation have been updated to exclusively use Let’s Encrypt certificates. Instead, Let’s Encrypt certificates should be presented merely as an example, rather than as the default or required approach.