Chapter 14. Enabling SSL/TLS on overcloud public endpoints

Procedure

1. The /etc/pki/CA/index.txt file contains records of all signed certificates. Ensure that the filesystem path and index.txt file are present:

   $ sudo mkdir -p /etc/pki/CA
   $ sudo touch /etc/pki/CA/index.txt

2. The /etc/pki/CA/serial file identifies the next serial number to use for the next certificate to sign. Check if this file exists. If the file does not exist, create a new file with a new starting value:

   $ echo '1000' | sudo tee /etc/pki/CA/serial

Procedure

1. Generate a key and certificate pair to act as the certificate authority:

   $ openssl genrsa -out ca.key.pem 4096
   $ openssl req  -key ca.key.pem -new -x509 -days 7300 -extensions v3_ca -out ca.crt.pem

2. The openssl req command requests certain details about your authority. Enter these details at the prompt. These commands create a certificate authority file called ca.crt.pem.

3. Set the certificate location as the value for the PublicTLSCAFile parameter in the enable-tls.yaml file. When you set the certificate location as the value for the PublicTLSCAFile parameter, you ensure that the CA certificate path is added to the clouds.yaml authentication file.

   parameter_defaults:
       PublicTLSCAFile: /etc/pki/ca-trust/source/anchors/cacert.pem

Procedure

1. Copy the certificate authority to the client system:

   $ sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/

2. After you copy the certificate authority file to each client, run the following command on each client to add the certificate to the certificate authority trust bundle:

   $ sudo update-ca-trust extract

Procedure

1. Run the following command to generate the SSL/TLS key (server.key.pem):

   $ openssl genrsa -out server.key.pem 2048

Procedure

1. Copy the default OpenSSL configuration file:

   $ cp /etc/pki/tls/openssl.cnf .

2. Edit the new openssl.cnf file and configure the SSL parameters that you want to use for director. An example of the types of parameters to modify include:

   [req]
   distinguished_name = req_distinguished_name
   req_extensions = v3_req
   
   [req_distinguished_name]
   countryName = Country Name (2 letter code)
   countryName_default = AU
   stateOrProvinceName = State or Province Name (full name)
   stateOrProvinceName_default = Queensland
   localityName = Locality Name (eg, city)
   localityName_default = Brisbane
   organizationalUnitName = Organizational Unit Name (eg, section)
   organizationalUnitName_default = Red Hat
   commonName = Common Name
   commonName_default = 192.168.0.1
   commonName_max = 64
   
   [ v3_req ]
   # Extensions to add to a certificate request
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   subjectAltName = @alt_names
   
   [alt_names]
   IP.1 = 192.168.0.1
   DNS.1 = instack.localdomain
   DNS.2 = vip.localdomain
   DNS.3 = 192.168.0.1

   Set the commonName_default to one of the following entries:

   • If you are using an IP address to access director over SSL/TLS, use the undercloud_public_host parameter in the undercloud.conf file.
   • If you are using a fully qualified domain name to access director over SSL/TLS, use the domain name.

   Edit the alt_names section to include the following entries:

   • IP - A list of IP addresses that clients use to access director over SSL.
   • DNS - A list of domain names that clients use to access director over SSL. Also include the Public API IP address as a DNS entry at the end of the alt_names section.
   Note

   For more information about openssl.cnf, run the man openssl.cnf command.

3. Run the following command to generate a certificate signing request (server.csr.pem):

   $ openssl req -config openssl.cnf -key server.key.pem -new -out server.csr.pem

   Ensure that you include your OpenStack SSL/TLS key with the -key option.

Procedure

1. Run the following command to create a certificate for your undercloud or overcloud:

   $ sudo openssl ca -config openssl.cnf -extensions v3_req -days 3650 -in server.csr.pem -out server.crt.pem -cert ca.crt.pem -keyfile ca.key.pem

   This command uses the following options:

   -config

   Use a custom configuration file, which is the openssl.cnf file with v3 extensions.

   -extensions v3_req

   Enabled v3 extensions.

   -days

   Defines how long in days until the certificate expires.

   -in'

   The certificate signing request.

   -out

   The resulting signed certificate.

   -cert

   The certificate authority file.

   -keyfile

   The certificate authority private key.

Procedure

1. Copy the enable-tls.yaml environment file from the heat template collection:

   $ cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml ~/templates/.

2. Edit this file and make the following changes for these parameters:

   SSLCertificate

   Copy the contents of the certificate file (server.crt.pem) into the SSLCertificate parameter:

   parameter_defaults:
     SSLCertificate: |
       -----BEGIN CERTIFICATE-----
       MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGS
       ...
       sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQ
       -----END CERTIFICATE-----

   Important

   The certificate contents require the same indentation level for all new lines.

   SSLIntermediateCertificate

   If you have an intermediate certificate, copy the contents of the intermediate certificate into the SSLIntermediateCertificate parameter:

   parameter_defaults:
     SSLIntermediateCertificate: |
       -----BEGIN CERTIFICATE-----
       sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvpBCwUAMFgxCzAJB
       ...
       MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQE
       -----END CERTIFICATE-----

   Important

   The certificate contents require the same indentation level for all new lines.

   SSLKey

   Copy the contents of the private key (server.key.pem) into the SSLKey parameter:

   parameter_defaults:
     ...
     SSLKey: |
       -----BEGIN RSA PRIVATE KEY-----
       MIIEowIBAAKCAQEAqVw8lnQ9RbeI1EdLN5PJP0lVO
       ...
       ctlKn3rAAdyumi4JDjESAXHIKFjJNOLrBmpQyES4X
       -----END RSA PRIVATE KEY-----

   Important

   The private key contents require the same indentation level for all new lines.

Procedure

1. Copy the inject-trust-anchor-hiera.yaml environment file from the heat template collection:

   $ cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor-hiera.yaml ~/templates/.

Procedure

1. Edit your heat templates with the following content:

   • Edit the enable-tls.yaml file and update the SSLCertificate, SSLKey, and SSLIntermediateCertificate parameters.
   • If your certificate authority has changed, edit the inject-trust-anchor-hiera.yaml file and update the CAMap parameter.

2. Rerun the deployment command:

   $ openstack overcloud deploy --templates \
   [...]
   -e /home/stack/templates/enable-tls.yaml \
   -e ~/templates/custom-domain.yaml \
   -e ~/templates/inject-trust-anchor-hiera.yaml \
   -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml

3. On the director, run the following command for each Controller:

   ssh heat-admin@<controller> sudo podman \
   restart $(podman ps --format="{{.Names}}" | grep -w -E 'haproxy(-bundle-.*-[0-9]+)?')