Red Hat Training
A Red Hat training course is available for Red Hat OpenStack Platform
15.7. 启用 SSL/TLS
从 Heat 模板集合中复制 enable-tls.yaml
环境文件:
$ cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml ~/templates/.
编辑此文件并对这些参数进行以下更改:
- SSLCertificate
将证书文件的内容(
server.crt.pem
)复制到SSLCertificate
参数。例如:parameter_defaults: SSLCertificate: | -----BEGIN CERTIFICATE----- MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV ... sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvp -----END CERTIFICATE-----
- SSLIntermediateCertificate
如果您有中间证书,请将中间证书的内容复制到
SSLIntermediateCertificate
参数中:parameter_defaults: SSLIntermediateCertificate: | -----BEGIN CERTIFICATE----- sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvpBCwUAMFgxCzAJB ... MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQE -----END CERTIFICATE-----
重要证书内容为所有新行都需要相同的缩进级别。
- SSLKey
将私钥(
server.key.pem
)的内容复制到SSLKey
参数。例如:parameter_defaults: ... SSLKey: | -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAqVw8lnQ9RbeI1EdLN5PJP0lVO9hkJZnGP6qb6wtYUoy1bVP7 ... ctlKn3rAAdyumi4JDjESAXHIKFjJNOLrBmpQyES4XpZUC7yhqPaU -----END RSA PRIVATE KEY-----
重要私钥内容需要对所有新行的缩进级别相同。
- OS::TripleO::NodeTLSData
将
OS::TripleO::NodeTLSData 的资源
路径改为绝对路径:resource_registry: OS::TripleO::NodeTLSData: /usr/share/openstack-tripleo-heat-templates/puppet/extraconfig/tls/tls-cert-inject.yaml