Chapter 6. Configuring custom SSL/TLS certificates
Chapter 6. Configuring custom SSL/TLS certificates You can manually configure the undercloud to use SSL/TLS for communication over public endpoints. When you manually configure undercloud endpoints with SSL/TLS, you are creating secure endpoints as a proof-of-concept. Red Hat recommends using a certificate authority solution. When you use a certificate authority (CA) solution, you have production ready solutions such as a certificate renewals, certificate revocation lists (CRLs), and industry accepted cryptography. For information on using Red Hat Identity Manager (IdM) as a CA, see Implementing TLS-e with Ansible . If you want to use a SSL certificate with your own certificate authority, you must complete the following configuration steps. 6.1. Initializing the signing host The signing host is the host that generates and signs new certificates with a certificate authority. If you have never created SSL certificates on the chosen signing host, you might need to initialize the host so that it can sign new certificates. Procedure The /etc/pki/CA/index.txt file contains records of all signed certificates. Ensure that the filesystem path and index.txt file are present: The /etc/pki/CA/serial file identifies the serial number to use for the certificate to sign. Check if this file exists. If the file does not exist, create a new file with a new starting value: 6.2. Creating a certificate authority Normally you sign your SSL/TLS certificates with an external certificate authority. In some situations, you might want to use your own certificate authority. For example, you might want to have an internal-only certificate authority. Procedure Generate a key and certificate pair to act as the certificate authority: The openssl req command requests certain details about your authority. Enter these details at the prompt. These commands create a certificate authority file called ca.crt.pem . Set the certificate location as the value for the PublicTLSCAFile parameter in the enable-tls.yaml file. When you set the certificate location as the value for the PublicTLSCAFile parameter, you ensure that the CA certificate path is added to the clouds.yaml authentication file. 6.3. Adding the certificate authority to clients For any external clients aiming to communicate using SSL/TLS, copy the certificate authority file to each client that requires access to your Red Hat OpenStack Platform environment. Procedure Copy the certificate authority to the client system: After you copy the certificate authority file to each client, run the following command on each client to add the certificate to the certificate authority trust bundle: 6.4. Creating an SSL/TLS key Enabling SSL/TLS on an OpenStack environment requires an SSL/TLS key to generate your certificates. Procedure Run the following command to generate the SSL/TLS key ( server.key.pem ): 6.5. Creating an SSL/TLS certificate signing request Complete the following steps to create a certificate signing request. Procedure Copy the default OpenSSL configuration file: Edit the new openssl.cnf file and configure the SSL parameters that you want to use for director. An example of the types of parameters to modify include: Set the commonName_default to one of the following entries: If you are using an IP address to access director over SSL/TLS, use the undercloud_public_host parameter in the undercloud.conf file. If you are using a fully qualified domain name to access director over SSL/TLS, use the domain name. Edit the alt_names section to include the following entries: IP - A list of IP addresses that clients use to access director over SSL. DNS - A list of domain names that clients use to access director over SSL. Also include the Public API IP address as a DNS entry at the end of the alt_names section. Note For more information about openssl.cnf , run the man openssl.cnf command. Run the following command to generate a certificate signing request ( server.csr.pem ): Ensure that you include your OpenStack SSL/TLS key with the -key option. This command generates a server.csr.pem file, which is the certificate signing request. Use this file to create your OpenStack SSL/TLS certificate. 6.6. Creating the SSL/TLS certificate To generate the SSL/TLS certificate for your OpenStack environment, the following files must be present: openssl.cnf The customized configuration file that specifies the v3 extensions. server.csr.pem The certificate signing request to generate and sign the certificate with a certificate authority. ca.crt.pem The certificate authority, which signs the certificate. ca.key.pem The certificate authority private key. Procedure Create the newcerts directory if it does not already exist: Run the following command to create a certificate for your undercloud or overcloud: This command uses the following options: -config Use a custom configuration file, which is the openssl.cnf file with v3 extensions. -extensions v3_req Enabled v3 extensions. -days Defines how long in days until the certificate expires. -in The certificate signing request. -out The resulting signed certificate. -cert The certificate authority file. -keyfile The certificate authority private key. This command creates a new certificate named server.crt.pem . Use this certificate in conjunction with your OpenStack SSL/TLS key 6.7. Adding the certificate to the undercloud Complete the following steps to add your OpenStack SSL/TLS certificate to the undercloud trust bundle. Procedure Run the following command to combine the certificate and key: This command creates a undercloud.pem file. Copy the undercloud.pem file to a location within your /etc/pki directory and set the necessary SELinux context so that HAProxy can read it: Add the undercloud.pem file location to the undercloud_service_certificate option in the undercloud.conf file: Do not set or enable the generate_service_certificate and certificate_generation_ca parameters. Director uses these parameters to automatically generate a certificate instead of using the undercloud.pem certificate you created manually. Add the certificate authority that signed the certificate to the list of trusted Certificate Authorities on the undercloud so that different services within the undercloud have access to the certificate authority: To verify the certificate authority was added to the undercloud, use openssl to check the trust bundle: Replace <CN of the CA issuer> with the common name of the issuer of the CA. This command outputs the main certificate details, including the validity dates.
sudo mkdir -p /etc/pki/CA sudo touch /etc/pki/CA/index.txt echo '1000' | sudo tee /etc/pki/CA/serial openssl genrsa -out ca.key.pem 4096 openssl req -key ca.key.pem -new -x509 -days 7300 -extensions v3_ca -out ca.crt.pem parameter_defaults: PublicTLSCAFile: /etc/pki/ca-trust/source/anchors/cacert.pem sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/ sudo update-ca-trust extract openssl genrsa -out server.key.pem 2048 cp /etc/pki/tls/openssl.cnf . [req] distinguished_name = req_distinguished_name req_extensions = v3_req [req_distinguished_name] countryName = Country Name (2 letter code) countryName_default = AU stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Queensland localityName = Locality Name (eg, city) localityName_default = Brisbane organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = Red Hat commonName = Common Name commonName_default = 192.168.0.1 commonName_max = 64 Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] IP.1 = 192.168.0.1 DNS.1 = instack.localdomain DNS.2 = vip.localdomain DNS.3 = 192.168.0.1 openssl req -config openssl.cnf -key server.key.pem -new -out server.csr.pem sudo mkdir -p /etc/pki/CA/newcerts sudo openssl ca -config openssl.cnf -extensions v3_req -days 3650 -in server.csr.pem -out server.crt.pem -cert ca.crt.pem -keyfile ca.key.pem cat server.crt.pem server.key.pem > undercloud.pem sudo mkdir /etc/pki/undercloud-certs sudo cp ~/undercloud.pem /etc/pki/undercloud-certs/. sudo semanage fcontext -a -t etc_t "/etc/pki/undercloud-certs(/.*)?" sudo restorecon -R /etc/pki/undercloud-certs undercloud_service_certificate = /etc/pki/undercloud-certs/undercloud.pem sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/ sudo update-ca-trust extract openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs -text | grep <CN of the CA issuer> -A 10 -B 10