| Summary: | Adding a concrete example of creating self-signed CA cert with openssl. | ||
|---|---|---|---|
| Product: | Red Hat Update Infrastructure for Cloud Providers | Reporter: | Etsuji Nakai <enakai> |
| Component: | Documentation | Assignee: | Lana Brindley <lbrindle> |
| Status: | CLOSED WONTFIX | QA Contact: | wes hayutin <whayutin> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 2.1 | CC: | cmorgan, jslagle, kbidarka, mhideo, sghai, tsanders |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-05-11 14:07:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 817736 | ||
| Bug Blocks: | |||
|
Description
Etsuji Nakai
2012-04-02 03:32:42 UTC
This is how QE does it... export rhua=<rhua-internal-FQDN> export cds1=<cds01-internal-FQDN> export cds2=<cds02-internal-FQDN> mkdir -p /root/pem pushd /root/pem echo 10 > ca.srl openssl req -new -x509 -extensions v3_ca -keyout ca.key -subj "/C=US/ST=NC/L=Raleigh/CN=$rhua CA" -out ca.crt -days 365 openssl genrsa -out server.key 2048 for server in $rhua $cds1 $cds2 ; do echo -ne "\n\n\n## $server\n==" openssl req -new -key server.key -subj "/C=US/ST=NC/L=Raleigh/CN=$server" -out $server.csr || break openssl x509 -req -days 365 -CA ca.crt -CAkey ca.key -in $server.csr -out $server.crt || break done FWIW, I think this is a WONTFIX. I don't think we need or should tell people how to do this. Everyone is going to do it a little differently (as we've already seen). I think this is cursory information, we don't need to provide the exact steps. Kind of like we don't tell people what LVM commands to run to setup partitions, etc. I think it would be sufficient to say something like "go read openssl docs if you want to know how to do this". Again, assuming they even want to use openssl to do it. I agree it's up to the documentation team whether the exact/concrete steps should be included. However, from the current description, it's hard to understand, at first glance, that I have to prepare SSL key/cert file pairs for each of RHUA and CDS's corresponding to "rhua.key/rhua.crt" and "cds1.key/cds1.crt" in "3.2. Answers File". I think it should be stated that the generic "server.key/server.crt" in "Procedure 3.1. Configuring SSL Certificates" correspond to "rhua.key/rhua.crt" and "cds1.key/cds1.crt" in "3.2. Answers File". * Procedure 3.1. Configuring SSL Certificates http://docs.redhat.com/docs/en-US/Red_Hat_Update_Infrastructure/2.0/html/Installation_Guide/chap-Installation_Guide-RHUI_Installer.html#sect-Installation_Guide-RHUI_Installer-Setting_up_SSL * 3.2. Answers File http://docs.redhat.com/docs/en-US/Red_Hat_Update_Infrastructure/2.0/html/Installation_Guide/sect-Installation_Guide-RHUI_Installer-Answers_File.html This is handled in the services deployment guide. |