Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add section on certificates layout #965

Draft
wants to merge 1 commit into
base: develop
Choose a base branch
from
Draft

Add section on certificates layout #965

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 101 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,107 @@ This repository also contains the tooling required to install Foreman Katello.

See [KATELLO.md](/KATELLO.md) for details and specifics of that setup.

# Certificates

## Terminology

* **default CA** - a CA generated by the installer, and used to generate server and client certificates. This CA is used by Candlepin to generate client certificates.
* **server CA** - a CA that can be provided by the user, or is a copy of the default CA, used by all public facing interfaces
Comment on lines +118 to +119
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is really Katello terminology that we don't use for Foreman. I'd be explicit in that.

* **puppet CA** - a CA generated and managed by puppet

## Layout

### Foreman

The set of deployed certificates, private keys and CA certificates when using the Foreman scenario. Foreman defaults to using the Puppet CA, and users can provide their own certificates for any of the listed services.

| path | kind | service | issuer | CA |
|-------------------------------------------------------|--------|---------------|---------|---------|
| /etc/puppetlabs/puppet/ssl/certs/$hostname.pem | client | foreman | puppet | |
| /etc/puppetlabs/puppet/ssl/private_keys/$hostname.pem | key | foreman | | |
| /etc/puppetlabs/puppet/ssl/certs/ca.pem | CA | foreman | | puppet |
| /etc/puppetlabs/puppet/ssl/certs/$hostname.pem | server | websockify | puppet | |
| /etc/puppetlabs/puppet/ssl/private_keys/$hostname.pem | key | websockify | | |
| /etc/puppetlabs/puppet/ssl/certs/$hostname.pem | server | apache | puppet | |
| /etc/puppetlabs/puppet/ssl/private_keys/$hostname.pem | key | apache | | |
| /etc/puppetlabs/puppet/ssl/certs/ca.pem | CA | apache | | puppet |
| /etc/puppetlabs/puppet/ssl/certs/$hostname.pem | server | smart-proxy | puppet | |
| /etc/puppetlabs/puppet/ssl/private_keys/$hostname.pem | key | smart-proxy | | |
| /etc/puppetlabs/puppet/ssl/certs/ca.pem | CA | smart-proxy | | puppet |
| /etc/puppetlabs/puppet/ssl/certs/$hostname.pem | client | smart-proxy | puppet | |
| /etc/puppetlabs/puppet/ssl/private_keys/$hostname.pem | key | smart-proxy | | |
| /etc/puppetlabs/puppet/ssl/certs/ca.pem | CA | smart-proxy | | puppet |

### Katello

The set of deployed certificates, private keys and CA certificates when using the Katello scenario. Katello splits this into two phases: generation and deployment.
The generation of certificates is handled by [katello-certs-tools](https://github.com/Katello/katello-certs-tools) through puppet and then the puppet module will deploy them to standard locations.

Users may supply custom, also known as server certificates, for any public interfaces.
All client certificates, and the CA certificate used by Candlepin are generated and cannot be provided by a user.

#### Tooling

* Installs and deploys a CA
* Deploys certificates generated from the CA
* Uses [katello-certs-tools](https://github.com/Katello/katello-certs-tools) to generate certificates

#### Deployed Certificates

| path | kind | service | issuer | CA |
|-----------------------------------------------|--------|---------------|---------|---------|
| /etc/foreman/client_cert.pem | client | foreman | default | |
| /etc/foreman/client_key.pem | key | foreman | default | |
| /etc/foreman/proxy_ca.pem | CA | foreman | | server |
| /etc/pki/katello/certs/katello-apache.crt | server | apache | server | |
| /etc/pki/katello/private/katello-apache.key | key | apache | | |
| /etc/pki/katello/certs/katello-server-ca.crt | CA | apache | | server |
| /etc/pki/katello/certs/katello-default-ca.crt | CA | apache | | default |
| /etc/pki/katello/certs/katello-apache.crt | server | websockify | server | |
| /etc/pki/katello/private/katello-apache.key | key | websockify | | |
| /etc/pki/katello/private/\*-bundle.pem:cert | client | reverse-proxy | | |
| /etc/pki/katello/private/\*-bundle.pem:key | key | reverse-proxy | default | |
| /etc/foreman_proxy/ssl_cert.pem | server | smart-proxy | server | |
| /etc/foreman_proxy/ssl_key.pem | key | smart-proxy | server | |
| /etc/foreman_proxy/ssl_ca.pem | CA | smart-proxy | | default |
| /etc/foreman_proxy/foreman_ssl_cert.pem | client | smart-proxy | default | |
| /etc/foreman_proxy/foreman_ssl_key.pem | key | smart-proxy | default | |
| /etc/foreman_proxy/foreman_ssl_ca.pem | CA | smart-proxy | | server |
| /etc/candlepin/certs/candlepin-ca.crt | CA | candlepin | | default |
| /etc/candlepin/certs/candlepin-ca.key | key | candlepin | | default |
| /etc/candlepin/certs/truststore:artemis-client| client | artemis | default | |
| /etc/candlepin/certs/truststore:candlepin-ca | CA | tomcat | | default |
| /etc/candlepin/certs/keystore:tomcat | server | tomcat | default | |
| /etc/candlepin/certs/keystore:tomcat | key | tomcat | | |
| /etc/mosquitto/ssl/ssl_cert.pem | cert | mosquitto | server | |
| /etc/mosquitto/ssl/ssl_key.pem | key | mosquitto | | |
| /etc/mosquitto/ssl/ssl_ca.pem | CA | mosquitto | | default |
| /etc/pki/katello/puppet/puppet_client.crt | client | puppet | default | |
| /etc/pki/katello/puppet/puppet_client.key | key | puppet | | |
| /etc/pki/katello/puppet/puppet_client_ca.crt | CA | puppet | | server |

#### Generated Certificates

The certificates generated through [puppet-certs](https://github.com/theforeman/puppet-certs) using [katello-certs-tools](https://github.com/Katello/katello-certs-tools).

| path | kind | issuer | CA |
|--------------------------------------------------------------|--------|---------|---------|
| /root/ssl-build/katello-ca-opnessl.cnf | config | | default |
| /root/ssl-build/katello-default-ca.crt | CA | | default |
| /root/ssl-build/katello-default-ca.key | key | | default |
| /root/ssl-build/katello-server-ca.crt | CA | | server |
| /root/ssl-build/katello-server-ca.key | key | | server |
| /root/ssl-build/$hostname/$hostname-apache.crt | server | server | |
| /root/ssl-build/$hostname/$hostname-apache.key | key | | |
| /root/ssl-build/$hostname/$hostname-foreman-client.crt | client | default | |
| /root/ssl-build/$hostname/$hostname-foreman-client.key | key | | |
| /root/ssl-build/$hostname/$hostname-foreman-proxy-client.crt | client | default | |
| /root/ssl-build/$hostname/$hostname-foreman-proxy-client.key | key | | |
| /root/ssl-build/$hostname/$hostname-foreman-proxy.crt | client | server | |
| /root/ssl-build/$hostname/$hostname-foreman-proxy.key | key | | |
| /root/ssl-build/localhost/localhost-tomcat.crt | server | default | |
| /root/ssl-build/localhost/localhost-tomcat.key | key | | |

# More info

See http://theforeman.org or at #theforeman irc channel on freenode
Expand Down