Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

18.3. Remote Management over TLS and SSL

You can manage virtual machines using the TLS and SSL protocols. TLS and SSL provides greater scalability but is more complicated than SSH (refer to Section 18.2, “Remote Management with SSH”). TLS and SSL is the same technology used by web browsers for secure connections. The libvirt management connection opens a TCP port for incoming connections, which is securely encrypted and authenticated based on x509 certificates. The following procedures provide instructions on creating and deploying authentication certificates for TLS and SSL management.

Procedure 18.1. Creating a certificate authority (CA) key for TLS management

  1. Before you begin, confirm that gnutls-utils is installed. If not, install it: 
    # yum install gnutls-utils
  2. Generate a private key, using the following command: 
    # certtool --generate-privkey > cakey.pem
  3. After the key is generated, create a signature file so the key can be self-signed. To do this, create a file with signature details and name it ca.info. This file should contain the following: 
    cn = Name of your organization
ca
cert_signing_key
  4. Generate the self-signed key with the following command: 
    # certtool --generate-self-signed --load-privkey cakey.pem --template ca.info --outfile cacert.pem
    After the file is generated, the ca.info file can be deleted using the rm command. The file that results from the generation process is named cacert.pem. This file is the public key (certificate). The loaded file cakey.pem is the private key. For security purposes, this file should be kept private, and not reside in a shared space.
  5. Install the cacert.pem CA certificate file on all clients and servers in the /etc/pki/CA/cacert.pem directory to let them know that the certificate issued by your CA can be trusted. To view the contents of this file, run: 
    # certtool -i --infile cacert.pem
    This is all that is required to set up your CA. Keep the CA's private key safe, as you will need it in order to issue certificates for your clients and servers.

Procedure 18.2. Issuing a server certificate

This procedure demonstrates how to issue a certificate with the X.509 Common Name (CN) field set to the host name of the server. The CN must match the host name which clients will be using to connect to the server. In this example, clients will be connecting to the server using the URI: qemu://mycommonname/system, so the CN field should be identical, for this example "mycommoname".
  1. Create a private key for the server. 
    # certtool --generate-privkey > serverkey.pem
  2. Generate a signature for the CA's private key by first creating a template file called server.info. Make sure that the CN is set to be the same as the server's host name: 
    organization = Name of your organization
cn = mycommonname
tls_www_server
encryption_key
signing_key
  3. Create the certificate: 
    # certtool --generate-certificate --load-privkey serverkey.pem --load-ca-certificate cacert.pem --load-ca-privkey cakey.pem \ --template server.info --outfile servercert.pem
    This results in two files being generated:
    • serverkey.pem - The server's private key
    • servercert.pem - The server's public key
  4. Make sure to keep the location of the private key secret. To view the contents of the file, use the following command: 
    # certtool -i --infile servercert.pem
    When opening this file, the CN= parameter should be the same as the CN that you set earlier. For example, mycommonname.
  5. Install the two files in the following locations:
    • serverkey.pem - the server's private key. Place this file in the following location: /etc/pki/libvirt/private/serverkey.pem
    • servercert.pem - the server's certificate. Install it in the following location on the server: /etc/pki/libvirt/servercert.pem

Procedure 18.3. Issuing a client certificate

  1. For every client (that is to say any program linked with libvirt, such as virt-manager), you need to issue a certificate with the X.509 Distinguished Name (DN) field set to a suitable name. This needs to be decided on a corporate level.
    For example purposes, the following information will be used: 
    C=USA,ST=North Carolina,L=Raleigh,O=Red Hat,CN=name_of_client
  2. Create a private key: 
    # certtool --generate-privkey > clientkey.pem
  3. Generate a signature for the CA's private key by first creating a template file called client.info. The file should contain the following (fields should be customized to reflect your region/location): 
    country = USA
state = North Carolina
locality = Raleigh
organization = Red Hat
cn = client1
tls_www_client
encryption_key
signing_key
  4. Sign the certificate with the following command: 
    # certtool --generate-certificate --load-privkey clientkey.pem --load-ca-certificate cacert.pem \ --load-ca-privkey cakey.pem --template client.info --outfile clientcert.pem
  5. Install the certificates on the client machine: 
    # cp clientkey.pem /etc/pki/libvirt/private/clientkey.pem
# cp clientcert.pem /etc/pki/libvirt/clientcert.pem