Chapter 3. Installing CodeReady Workspaces in TLS mode with self-signed certificates

Procedure

1. Set the necessary environment variables:

   $ CA_CN="Local Red Hat CodeReady Workspaces Signer"
   $ DOMAIN=*.<expected.domain.com>
   $ OPENSSL_CNF=<path_to_openssl.cnf>

2. Generate the root Certificate Authority (CA) key. Add the -des3 parameter to use a passphrase:

   $ openssl genrsa -out ca.key 4096

3. Generate the root CA certificate:

   $ openssl req -x509 \
     -new -nodes \
     -key ca.key \
     -sha256 \
     -days 1024 \
     -out ca.crt \
     -subj /CN="${CA_CN}" \
     -reqexts SAN \
     -extensions SAN \
     -config <(cat ${OPENSSL_CNF} \
         <(printf '[SAN]\nbasicConstraints=critical, CA:TRUE\nkeyUsage=keyCertSign, cRLSign, digitalSignature'))

4. Generate the domain key:

   $ openssl genrsa -out domain.key 2048

5. Generate the certificate signing request for the domain:

   $ openssl req -new -sha256 \
       -key domain.key \
       -subj "/O=Local Red Hat CodeReady Workspaces/CN=${DOMAIN}" \
       -reqexts SAN \
       -config <(cat ${OPENSSL_CNF} \
           <(printf "\n[SAN]\nsubjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=digitalSignature, keyEncipherment, keyAgreement, dataEncipherment\nextendedKeyUsage=serverAuth")) \
       -out domain.csr

6. Generate the domain certificate:

   $ openssl x509 \
       -req \
       -sha256 \
       -extfile <(printf "subjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=digitalSignature, keyEncipherment, keyAgreement, dataEncipherment\nextendedKeyUsage=serverAuth") \
       -days 365 \
       -in domain.csr \
       -CA ca.crt \
       -CAkey ca.key \
       -CAcreateserial -out domain.crt

Procedure

1. Log in to the default OpenShift project:

   $ oc login -u <username> -p _<password>

2. Get the OpenShift 4 self-signed certificate:

   $ oc get secret router-ca -n openshift-ingress-operator -o jsonpath="{.data.tls\.crt}" | \
     base64 -d > ca.crt

3. Pre-create a namespace for CodeReady Workspaces:

   $ oc create namespace {prod-namespace}

4. Create a secret from the CA certificate:

   $ oc create secret generic self-signed-certificate --from-file=ca.crt -n={prod-namespace}

5. Deploy CodeReady Workspaces using crwctl:

   $ crwctl server:start --platform=openshift --installer=operator

   When using CodeReady Containers, substitute openshift in the above command with crc.

Procedure

1. Log in to the default OpenShift project:

   $ oc login -u system:admin --insecure-skip-tls-verify=true
   $ oc project default

2. Reconfigure the router with the generated certificate:

   $ oc delete secret router-certs
   $ cat domain.crt domain.key > openshift.crt
   $ oc create secret tls router-certs --key=domain.key --cert=openshift.crt
   $ oc rollout latest router

3. Create a namespace for CodeReady Workspaces:

   $ oc create namespace workspaces

4. Create a secret from the CA certificate:

   $ oc create secret generic self-signed-certificate --from-file=ca.crt -n=workspaces

5. Deploy CodeReady Workspaces using crwctl. Red Hat CodeReady Workspaces is installed with TLS mode by default:

   $ crwctl server:start --platform=openshift --installer=operator