Skip to content

Latest commit

 

History

History
134 lines (106 loc) · 4.56 KB

6-cert-management.rst

File metadata and controls

134 lines (106 loc) · 4.56 KB
Raw

Unit 6: Service certificates

You probably noticed that the web service was not hosted over HTTPS, so there is no TLS-based authentication or confidentiality. In this unit, we will issue an X.509 certificate for the web service via the Certmonger program.

Certmonger supports multiple CAs including FreeIPA's CA, and can generate keys, issue certificate requests, track certificates, and renew tracked certificates when the expiration time approaches. Will also use mod_ssl with Apache.

Issue the service certificate

Let's start by confirming that the HTTP service does not yet have a certificate:

[client]$ ipa service-show HTTP/client.ipademo.local
  Principal name: HTTP/client.ipademo.local@IPADEMO.LOCAL
  Principal alias: HTTP/client.ipademo.local@IPADEMO.LOCAL
  Keytab: True
  Managed by: client.ipademo.local

Enable and start Certmonger:

[client]$ sudo systemctl enable --now certmonger
Created symlink /etc/systemd/system/multi-user.target.wants/certmonger.service → /usr/lib/systemd/system/certmonger.service.

Now let's request a certificate. We will generate keys and store certificates in the NSS database at /etc/httpd/alias:

[client]$ sudo ipa-getcert request \
            -f /etc/pki/tls/certs/app.crt \
            -k /etc/pki/tls/private/app.key \
            -K HTTP/client.ipademo.local \
            -D client.ipademo.local
New signing request "20180603185400" added.

Let's break down some of those command arguments.

-k <path>
Path to private key (Certmonger will generate it)
-f <path>
Path to certificate (where it will be saved after being issued)
-K <principal>
Kerberos service principal; because different kinds of services may be accessed at one hostname, this argument tells Certmonger which service principal is the subject
-D <dnsname>
Requests the given domain name to appear in the Subject Alternative Name (SAN) extension; today the Common Name (CN) field is no longer used by browsers so the SAN value is essential

Another important option is -N <subject-name>. It defaults to the system hostname, which in our case (client.ipademo.local) is appropriate.

Let's check the status of our certificate request using the tracking identifier given in the ipa-getcert request output:

[client]$ sudo getcert list -i 20180603185400
Number of certificates and requests being tracked: 1.
Request ID '20180603185400':
  status: MONITORING
  stuck: no
  key pair storage: type=FILE,location='/etc/pki/tls/private/app.key'
  certificate: type=FILE,location='/etc/pki/tls/certs/app.crt'
  CA: IPA
  issuer: CN=Certificate Authority,O=IPADEMO.LOCAL
  subject: CN=client.ipademo.local,O=IPADEMO.LOCAL
  expires: 2020-06-03 18:54:00 UTC
  dns: client.ipademo.local
  principal name: HTTP/client.ipademo.local@IPADEMO.LOCAL
  key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
  eku: id-kp-serverAuth,id-kp-clientAuth
  pre-save command:
  post-save command:
  track: yes
  auto-renew: yes

Confirm that the certificate was issued and that Certmonger is now MONITORING the certificate and will auto-renew it when it is close to expiration. Now if you run ipa service-show, you will see a number of attributes related to the certificate, including the certificate itself. Can you work out how to save the PEM-encoded certificate to a file?

Set up TLS for Apache

Now we can reconfigure Apache to serve our app over TLS. Update app.conf to listen on port 443 and add the SSL directives:

...
Listen 443

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile "/etc/pki/tls/certs/app.crt"
    SSLCertificateKeyFile "/etc/pki/tls/private/app.key"

    ServerName client.ipademo.local
    ...

Restart Apache and make a request to the app over HTTPS:

[client]$ sudo systemctl restart httpd
[client]$ curl -u : --negotiate https://client.ipademo.local
LOGGED IN AS: alice@IPADEMO.LOCAL

REMOTE_* REQUEST VARIABLES:

  REMOTE_USER: alice@IPADEMO.LOCAL
  REMOTE_USER_GROUP_1: ipausers
  REMOTE_USER_GROUP_2: sysadmin
  REMOTE_USER_GROUP_N: 2
  REMOTE_USER_FIRSTNAME: Alice
  REMOTE_USER_LASTNAME: Alice
  REMOTE_USER_MAIL: alice@ipademo.local
  REMOTE_ADDR: 192.168.33.20
  REMOTE_PORT: 51876

You can now proceed to Unit 7: Replica installation or Unit 8: Sudo rule management. Otherwise, return to the curriculum overview to see all the options.