Required. - Secrets references a Secret with Pomerium bootstrap parameters.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
namespace/name format.
diff --git a/content/docs/reference/downstream-mtls-settings.mdx b/content/docs/reference/downstream-mtls-settings.mdx
index e68c6a244..3fed5d9b0 100644
--- a/content/docs/reference/downstream-mtls-settings.mdx
+++ b/content/docs/reference/downstream-mtls-settings.mdx
@@ -168,7 +168,7 @@ The Ingress Controller does not support these settings.
This matches the default behavior of many popular reverse proxies, such as Apache httpd and Caddy.
- Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
+ Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key-settings#signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
This mode also adds a requirement that any configured [**CRL**](#crl) is valid only between its `thisUpdate` and `nextUpdate` timestamps. _If an invalid CRL is provided for a certain CA, no certificates issued by that CA will be allowed._
diff --git a/content/docs/reference/signing-key.mdx b/content/docs/reference/signing-key.mdx
index 7ed4bc21a..3f1e75bec 100644
--- a/content/docs/reference/signing-key.mdx
+++ b/content/docs/reference/signing-key.mdx
@@ -108,11 +108,11 @@ With sufficient time between the steps, this process should be resilient to cach
## Signing Key File
-**Signing Key File** is the path to a file containing a [Signing Key](./signing-key).
+**Signing Key File** is the path to a file containing a [Signing Key](#signing-key).
The signing key is the private key used to sign a user's attestation JWT, which can be consumed by upstream applications to pass along identifying user session information such as username, id, and groups.
-See [Signing Key](./signing-key) for more information.
+See [Signing Key](#signing-key) for more information.
### How to configure
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index d604ec332..1f2fa0962 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret-settings#shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with:
@@ -182,7 +182,7 @@ Pomerium Enterprise will log a shared secret mismatch with:
}
```
-Update the [shared secret](/docs/reference/shared-secret) across all Pomerium services to match the one set for the Databroker.
+Update the [shared secret](/docs/reference/shared-secret-settings#shared-secret) across all Pomerium services to match the one set for the Databroker.
### RPC Errors
diff --git a/content/examples/tooljet/config-tooljet.yaml.md b/content/examples/tooljet/config-tooljet.yaml.md
index 2517fcb13..9f33b651b 100644
--- a/content/examples/tooljet/config-tooljet.yaml.md
+++ b/content/examples/tooljet/config-tooljet.yaml.md
@@ -6,7 +6,7 @@ idp_provider: github
idp_client_id: REPLACE_ME
idp_client_secret: REPLACE_ME
-# Update the signing key: https://www.pomerium.com/docs/reference/signing-key
+# Update the signing key: https://www.pomerium.com/docs/reference/signing-key-settings#signing-key
signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSURRemVZWDZyT2tuemFnTjRJVTYxaEtRc3pzY1EvRllmbzZPcXhWd2YvdGZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFc1V0V2psYXZ3eHprSU9DVUNDeFVnTDJza2NjL3QxSTFmQXlxUDgrMWw5YU1CWDlzdm1pYgpRajJxcWFUbUJZZWhuQzhmak5LODZmVXhpc3d1SXN5bnp3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
routes:
From 0f885a70328e55acba4dc3ab6d705c226969d0a4 Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Thu, 25 Jul 2024 11:25:14 -0400
Subject: [PATCH 04/16] runs prettier
---
content/docs/reference/shared-secret.mdx | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/content/docs/reference/shared-secret.mdx b/content/docs/reference/shared-secret.mdx
index b59e09666..3f3836771 100644
--- a/content/docs/reference/shared-secret.mdx
+++ b/content/docs/reference/shared-secret.mdx
@@ -24,9 +24,9 @@ import TabItem from '@theme/TabItem';
Required. - Secrets references a Secret with Pomerium bootstrap parameters.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
namespace/name format.
diff --git a/content/docs/reference/downstream-mtls-settings.mdx b/content/docs/reference/downstream-mtls-settings.mdx
index 3fed5d9b0..c1cbe47e4 100644
--- a/content/docs/reference/downstream-mtls-settings.mdx
+++ b/content/docs/reference/downstream-mtls-settings.mdx
@@ -168,7 +168,7 @@ The Ingress Controller does not support these settings.
This matches the default behavior of many popular reverse proxies, such as Apache httpd and Caddy.
- Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key-settings#signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
+ Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key#signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
This mode also adds a requirement that any configured [**CRL**](#crl) is valid only between its `thisUpdate` and `nextUpdate` timestamps. _If an invalid CRL is provided for a certain CA, no certificates issued by that CA will be allowed._
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index 1f2fa0962..6280d8d05 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret-settings#shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret#shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with:
@@ -182,7 +182,7 @@ Pomerium Enterprise will log a shared secret mismatch with:
}
```
-Update the [shared secret](/docs/reference/shared-secret-settings#shared-secret) across all Pomerium services to match the one set for the Databroker.
+Update the [shared secret](/docs/reference/shared-secret#shared-secret) across all Pomerium services to match the one set for the Databroker.
### RPC Errors
diff --git a/content/examples/tooljet/config-tooljet.yaml.md b/content/examples/tooljet/config-tooljet.yaml.md
index 9f33b651b..6b5a35762 100644
--- a/content/examples/tooljet/config-tooljet.yaml.md
+++ b/content/examples/tooljet/config-tooljet.yaml.md
@@ -6,7 +6,7 @@ idp_provider: github
idp_client_id: REPLACE_ME
idp_client_secret: REPLACE_ME
-# Update the signing key: https://www.pomerium.com/docs/reference/signing-key-settings#signing-key
+# Update the signing key: https://www.pomerium.com/docs/reference/signing-key#signing-key
signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSURRemVZWDZyT2tuemFnTjRJVTYxaEtRc3pzY1EvRllmbzZPcXhWd2YvdGZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFc1V0V2psYXZ3eHprSU9DVUNDeFVnTDJza2NjL3QxSTFmQXlxUDgrMWw5YU1CWDlzdm1pYgpRajJxcWFUbUJZZWhuQzhmak5LODZmVXhpc3d1SXN5bnp3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
routes:
From af52451bef585700c49afadf147328d62875a054 Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Thu, 25 Jul 2024 17:42:18 -0400
Subject: [PATCH 09/16] runs prettier
---
content/docs/reference/shared-secret.mdx | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/content/docs/reference/shared-secret.mdx b/content/docs/reference/shared-secret.mdx
index bcc031cbd..448796796 100644
--- a/content/docs/reference/shared-secret.mdx
+++ b/content/docs/reference/shared-secret.mdx
@@ -30,8 +30,8 @@ If you adjust your shared secret and/or how it's accessed by Pomerium, you may c
Required. - Secrets references a Secret with Pomerium bootstrap parameters.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
namespace/name format.
diff --git a/content/docs/reference/downstream-mtls-settings.mdx b/content/docs/reference/downstream-mtls-settings.mdx
index c1cbe47e4..e68c6a244 100644
--- a/content/docs/reference/downstream-mtls-settings.mdx
+++ b/content/docs/reference/downstream-mtls-settings.mdx
@@ -168,7 +168,7 @@ The Ingress Controller does not support these settings.
This matches the default behavior of many popular reverse proxies, such as Apache httpd and Caddy.
- Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key#signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
+ Note that in this mode, client certificates will be required even for internal Pomerium routes, such as the authenticate URL (if using the self-hosted authenticate service) and the /.pomerium/ page (the page showing details of a user's current login session). In particular, any upstream services that perform [JWT verification](/docs/capabilities/getting-users-identity) will not be able to access the default [JWKS endpoint](/docs/reference/signing-key#how-to-use-signing-key). You may need to host your own JWKS endpoint, or provide some other means of distributing the JWT verification key(s).
This mode also adds a requirement that any configured [**CRL**](#crl) is valid only between its `thisUpdate` and `nextUpdate` timestamps. _If an invalid CRL is provided for a certain CA, no certificates issued by that CA will be allowed._
diff --git a/content/examples/tooljet/config-tooljet.yaml.md b/content/examples/tooljet/config-tooljet.yaml.md
index 6b5a35762..2517fcb13 100644
--- a/content/examples/tooljet/config-tooljet.yaml.md
+++ b/content/examples/tooljet/config-tooljet.yaml.md
@@ -6,7 +6,7 @@ idp_provider: github
idp_client_id: REPLACE_ME
idp_client_secret: REPLACE_ME
-# Update the signing key: https://www.pomerium.com/docs/reference/signing-key#signing-key
+# Update the signing key: https://www.pomerium.com/docs/reference/signing-key
signing_key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSURRemVZWDZyT2tuemFnTjRJVTYxaEtRc3pzY1EvRllmbzZPcXhWd2YvdGZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFc1V0V2psYXZ3eHprSU9DVUNDeFVnTDJza2NjL3QxSTFmQXlxUDgrMWw5YU1CWDlzdm1pYgpRajJxcWFUbUJZZWhuQzhmak5LODZmVXhpc3d1SXN5bnp3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
routes:
From b83690d10ce65a414d5eb04055d30e3e39c963c0 Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Fri, 26 Jul 2024 10:58:58 -0400
Subject: [PATCH 11/16] runs prettier
---
content/docs/capabilities/getting-users-identity.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/docs/capabilities/getting-users-identity.md b/content/docs/capabilities/getting-users-identity.md
index 1548749e0..0db177e8f 100644
--- a/content/docs/capabilities/getting-users-identity.md
+++ b/content/docs/capabilities/getting-users-identity.md
@@ -167,4 +167,4 @@ In an actual client, you'll want to ensure that all the other claims values are
[key management service]: https://en.wikipedia.org/wiki/Key_management
[nist p-256]: https://csrc.nist.gov/csrc/media/events/workshop-on-elliptic-curve-cryptography-standards/documents/papers/session6-adalier-mehmet.pdf
[pass identity headers]: /docs/reference/routes/pass-identity-headers-per-route
-[signing key]: /docs/reference/signing-key
\ No newline at end of file
+[signing key]: /docs/reference/signing-key
From f9bcb03dd3363f4b03f5f6a35d7a1af5dddbf016 Mon Sep 17 00:00:00 2001
From: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>
Date: Tue, 30 Jul 2024 10:16:52 -0700
Subject: [PATCH 12/16] revert some unnecessary changes
Revert the addition of some #shared-secret anchor tags in links, the
change to the sidebar label for the Signing Key page, and remove two
unnecessary redirects.
---
content/docs/internals/data-storage.md | 2 +-
content/docs/k8s/reference.md | 2 +-
content/docs/reference/signing-key.mdx | 1 -
content/docs/troubleshooting.mdx | 4 ++--
static/_redirects | 8 +++-----
5 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/content/docs/internals/data-storage.md b/content/docs/internals/data-storage.md
index ff6bce33b..f3229b778 100644
--- a/content/docs/internals/data-storage.md
+++ b/content/docs/internals/data-storage.md
@@ -94,4 +94,4 @@ Configuration options for each backend are detailed in the [**databroker configu
## Troubleshooting
-Most issues with the Databroker service are caused by a [`shared_secret`](/docs/reference/shared-secret#shared-secret) mismatch between services. See [Troubleshooting - Shared Secret Mismatch](/docs/reference/shared-secret#shared-secret) for details.
+Most issues with the Databroker service are caused by a [`shared_secret`](/docs/reference/shared-secret) mismatch between services. See [Troubleshooting - Shared Secret Mismatch](/docs/reference/shared-secret) for details.
diff --git a/content/docs/k8s/reference.md b/content/docs/k8s/reference.md
index f79283c60..5c5032587 100644
--- a/content/docs/k8s/reference.md
+++ b/content/docs/k8s/reference.md
@@ -216,7 +216,7 @@ PomeriumSpec defines Pomerium-specific configuration parameters.
Required. - Secrets references a Secret with Pomerium bootstrap parameters.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
shared_secret - secures inter-Pomerium service communications. cookie_secret - encrypts Pomerium session browser cookie. See also other Cookie parameters. signing_key signs Pomerium JWT assertion header. See Getting the user's identity guide. In a default Pomerium installation manifest, they would be generated via a one-time job and stored in a pomerium/bootstrap Secret. You may re-run the job to rotate the secrets, or update the Secret values manually.
namespace/name format.
diff --git a/content/docs/reference/signing-key.mdx b/content/docs/reference/signing-key.mdx
index 6d81e03a7..c976ec280 100644
--- a/content/docs/reference/signing-key.mdx
+++ b/content/docs/reference/signing-key.mdx
@@ -3,7 +3,6 @@
id: signing-key
title: Signing Key
-sidebar_label: Signing Key Settings
description: |
This page discusses the signing key settings Pomerium uses to sign the Pomerium JWT that's sent to upstream services to verify a user's identity.
keywords:
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index 6280d8d05..d604ec332 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret#shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with:
@@ -182,7 +182,7 @@ Pomerium Enterprise will log a shared secret mismatch with:
}
```
-Update the [shared secret](/docs/reference/shared-secret#shared-secret) across all Pomerium services to match the one set for the Databroker.
+Update the [shared secret](/docs/reference/shared-secret) across all Pomerium services to match the one set for the Databroker.
### RPC Errors
diff --git a/static/_redirects b/static/_redirects
index 0df898ef8..dc9ac3a94 100644
--- a/static/_redirects
+++ b/static/_redirects
@@ -462,13 +462,11 @@ https://0-20-0.docs.pomerium.com/category/guides https://0-20-0.docs.pomerium.co
/docs/reference/x-forwarded-for-http-header /docs/reference/x-forwarded-for-settings#skip-xff-append
/docs/reference/the-number-of-trusted-hops /docs/reference/x-forwarded-for-settings#xff-number-of-trusted-hops
-# Signing Key settings
-/docs/reference/signing-key /docs/reference/signing-key
+# Signing Key
/docs/reference/signing-key-file /docs/reference/signing-key
-# Shared Secret settings
-/docs/reference/shared-secret /docs/reference/shared-secret-settings
-/docs/reference/shared-secret-file /docs/reference/shared-secret-settings
+# Shared Secret
+/docs/reference/shared-secret-file /docs/reference/shared-secret
# Topics links - now concepts
/docs/topics/auth-logs /docs/capabilities/audit-logs
From 485701c129c5e0eba5dec2af357fd281476296db Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Tue, 30 Jul 2024 14:27:55 -0400
Subject: [PATCH 13/16] Update
content/docs/capabilities/getting-users-identity.md
Co-authored-by: Kenneth Jenkins <51246568+kenjenkins@users.noreply.github.com>
---
content/docs/capabilities/getting-users-identity.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/docs/capabilities/getting-users-identity.md b/content/docs/capabilities/getting-users-identity.md
index 0db177e8f..34f3463ef 100644
--- a/content/docs/capabilities/getting-users-identity.md
+++ b/content/docs/capabilities/getting-users-identity.md
@@ -98,7 +98,7 @@ curl https://your-app.corp.example.com/.well-known/pomerium/jwks.json | jq
:::caution
-In order to use the `/.well-known/pomerium/jwks.json` endpoint, you must set either [Signing Key] configuration option.
+In order to use the `/.well-known/pomerium/jwks.json` endpoint, you must set the [Signing Key] configuration option.
:::
From 029bc6b55538bca3c2d8ac32074f17aa7ee013ca Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Tue, 30 Jul 2024 16:06:41 -0400
Subject: [PATCH 14/16] updates 'share' to 'contain'
---
content/docs/troubleshooting.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index d604ec332..e63ae9101 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services share a mismatched secret, or these services share a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services contain a mismatched secret, or these services contain a secret that is not the same secret set in the Databroker service, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with:
From 97ec41ee53c9ed6f4d4a3ab128da2e1d8a7c7530 Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Tue, 30 Jul 2024 16:10:33 -0400
Subject: [PATCH 15/16] updates contain to exchange
---
content/docs/troubleshooting.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index e63ae9101..1ce1f4e33 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services contain a mismatched secret, or these services contain a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services exchange a mismatched secret, or these services exchange a secret that is not the same secret set in the Databroker service, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with:
From f8e49dc7f4c8c8de4e6b23d4ce6b9f8f9d4379fc Mon Sep 17 00:00:00 2001
From: zachary painter <60552605+ZPain8464@users.noreply.github.com>
Date: Tue, 30 Jul 2024 17:38:37 -0400
Subject: [PATCH 16/16] updates wording
---
content/docs/troubleshooting.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/docs/troubleshooting.mdx b/content/docs/troubleshooting.mdx
index 1ce1f4e33..be2b1787e 100644
--- a/content/docs/troubleshooting.mdx
+++ b/content/docs/troubleshooting.mdx
@@ -148,7 +148,7 @@ Events:
### Shared Secret Mismatch
-Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). When Pomerium services exchange a mismatched secret, or these services exchange a secret that is not the same secret set in the Databroker service, Pomerium will fail.
+Pomerium's independent services communicate securely using a [shared secret](/docs/reference/shared-secret). If any services have mismatched secrets, Pomerium will fail.
Pomerium Core will log a shared secret mismatch with: