Attachment 898254 Details for Bug 1100173 – tls configuration

tls configuration

tls.txt (text/plain), 2.17 KB, created by zhengqin on 2014-05-22 07:37:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: zhengqin

Created: 2014-05-22 07:37:27 UTC

Size: 2.17 KB

patch

obsolete

>On server (dhcp-66.70.159.nay.redhat.com)
>
>1. Set up a Certificate Authority (CA)
>
>1.1 # certtool --generate-privkey > cakey.pem
>
>1.2 self-sign cakey.pem by creating a file with the signature details called ca.info containing:
>
>cn = dhcp-66.70.159.nay.redhat.com
>ca
>cert_signing_key
>
>1.3 # certtool --generate-self-signed --load-privkey cakey.pem --template ca.info --outfile cacert.pem
>
>2. Create server certificates
>
>2.1 certtool --generate-privkey > serverkey.pem
>
>2.2 sign that key with the CA's private key by first creating a template file called server.info
>    
>organization = Red Hat
>cn = dhcp-66.70.159.nay.redhat.com
>tls_www_server
>encryption_key
>signing_key
>
>2.3 # certtool --generate-certificate --load-privkey serverkey.pem --load-ca-certificate cacert.pem \
>--load-ca-privkey cakey.pem --template server.info --outfile servercert.pem
>
>3. Copy CA key and server key to correct directory
>
>3.1 # cp cakey.pem cacert.pem /etc/pki/CA
>
>3.2 # mkdir -p /etc/pki/libvirt/private
>
>3.3 # cp serverkey.pem /etc/pki/libvirt/private
>
>3.4 # cp servercert.pem /etc/pki/libvirt
>
>4. Turn on libvird monitor listening in /etc/sysconfig/libvirtd
>  -- uncomment LIBVIRTD_ARGS="--listen"
>
>5. Edit /etc/libvirt/libvirtd.conf
>  -- enbale listen_tls = 1
>
>auth_tls = "sasl"
>
>#echo redhat |saslpasswd2 -p -a libvirt redhat
>
>6. # service libvirtd restart
>
>7. # service iptables stop
>
>
>On client (dhcp-66.70.159.nay.redhat.com)
>
>8.  Create client certificates
>
>8.1 # certtool --generate-privkey > clientkey.pem
>
>8.2 Act as CA and sign the certificate.  Create client.info containing:
>
>country = GB
>state = London
>locality = London
>organization = Red Hat
>cn = dhcp-66.70.159.nay.redhat.com
>tls_www_client
>encryption_key
>signing_key
>
>8.3 # certtool --generate-certificate  --load-privkey clientkey.pem --load-ca-certificate /etc/pki/CA/cacert.pem \
>--load-ca-privkey /etc/pki/CA/cakey.pem --template client.info --outfile clientcert.pem
>
>9. Copy client key to correct directory
>
>9.1 # mkdir -p /etc/pki/libvirt/private
>
>9.2 # cp clientkey.pem /etc/pki/libvirt/private
>
>9.3 # cp clientcert.pem /etc/pki/libvirt/
>
>10. Conect to server hypervisor
>
># virsh -c qemu+tls://dhcp-66-70-159.nay.redhat.com/system
>
>input ID: redhat  passwd:redhat

Actions: View

Attachments on bug 1100173: 898254