Attachment 878947 Details for Bug 1080501 – The configuration of tls

The configuration of tls

tls_config.txt (text/plain), 2.08 KB, created by zhenfeng wang on 2014-03-26 10:24:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: zhenfeng wang

Created: 2014-03-26 10:24:03 UTC

Size: 2.08 KB

patch

obsolete

>On server (server1)
>
>1. Set up a Certificate Authority (CA)
>
>1.1 # certtool --generate-privkey > cakey.pem
>
>1.2 self-sign cakey.pem by creating a file with the signature details called ca.info containing:
>
>cn = server1
>ca
>cert_signing_key
>
>1.3 # certtool --generate-self-signed --load-privkey cakey.pem --template ca.info --outfile cacert.pem
>
>2. Create server certificates
>
>2.1 certtool --generate-privkey > serverkey.pem
>
>2.2 sign that key with the CA's private key by first creating a template file called server.info
>    
>organization = Red Hat
>cn = server1
>tls_www_server
>encryption_key
>signing_key
>
>2.3 # certtool --generate-certificate --load-privkey serverkey.pem --load-ca-certificate cacert.pem \
>--load-ca-privkey cakey.pem --template server.info --outfile servercert.pem
>
>3. Copy CA key and server key to correct directory
>
>3.1 # cp cakey.pem cacert.pem /etc/pki/CA
>
>3.2 # mkdir -p /etc/pki/libvirt/private
>
>3.3 # cp serverkey.pem /etc/pki/libvirt/private
>
>3.4 # cp servercert.pem /etc/pki/libvirt
>
>4. Copy CA key to client(client1) into correct directory
>
>4.1 # scp cakey.pem cacert.pem root@client1:/etc/pki/CA
>
>5. Turn on libvird monitor listening in /etc/sysconfig/libvirtd
>  -- uncomment LIBVIRTD_ARGS="--listen"
>
>6. Edit /etc/libvirt/libvirtd.conf
>  -- enbale listen_tls = 1
>
>auth_tls = "none"
>
>7. # service libvirtd restart
>
>8. # service iptables stop
>
>
>On client (client1)
>
>9.  Create client certificates
>
>9.1 # certtool --generate-privkey > clientkey.pem
>
>9.2 Act as CA and sign the certificate.  Create client.info containing:
>
>country = GB
>state = London
>locality = London
>organization = Red Hat
>cn = client1
>tls_www_client
>encryption_key
>signing_key
>
>9.3 # certtool --generate-certificate  --load-privkey clientkey.pem --load-ca-certificate /etc/pki/CA/cacert.pem \
>--load-ca-privkey /etc/pki/CA/cakey.pem --template client.info --outfile clientcert.pem
>
>10. Copy client key to correct directory
>
>10.1 # mkdir -p /etc/pki/libvirt/private
>
>10.2 # cp clientkey.pem /etc/pki/libvirt/private
>
>10.3 # cp clientcert.pem /etc/pki/libvirt/
>
>11. Conect to server hypervisor
>
># virsh -c qemu+tls://server1/system

Actions: View

Attachments on bug 1080501: 878947 | 878948 | 879426