Hi All, I'm running an (experimental) 3-Node Ceph Reef (v18.2.4) Cluster. Each of the 3 nodes runs (amongst other services) the Ceph Dashboard - for fail-over purposes. I can connect to the Ceph Dashboard when not using TLS (ie ceph config set mgr mgr/dashboard/ssl false). I've got a private PKI (Step-CA) and I'd like to use its TLS Certificates for the Ceph Dashboard. The private PKI's CA Cert has been added to my browser, and internal websites, etc, using the internal PKI's Certificates work as expected. I'd like each of the three Ceph Nodes to use their own TLS Certificate. The 3 node's hostnames are ceph01.example.com, ceph02.example.com, and ceph03.example.com. The 3 node's mgr instances are (I think; & this could be where I'm going wrong) are mgr.ceph01, mgr.ceph02, and mgr.ceph03. I've created 3 TLS Certificates with names of cephdash-ceph01.example.com.crt, etc, CNs of cephdash-ceph01.example.com, etc, and SANs of ceph01.example.com, etc I've followed the documentation here: https://docs.ceph.com/en/reef/mgr/dashboard/#ssl-tls-support I have stopped and restarted the Ceph Dashboard service. Commands used (on ceph01.example.com): ceph dashboard set-ssl-certificate ceph01 -i cephdash-ceph01.example.com.crt ceph dashboard set-ssl-certificate-key ceph01 -i cephdash-ceph01.example.com.key ceph mgr module disable dashboard ceph mgr module enable dashboard It's not working (I get an Unable to connect page), and I can't work out why - but I suspect it'll be something bleedingly obvious. :-) My Qs: Can I use EC Certs or must I use RSA Certs? I've tryied both and neither work. Can anyone spot what I'm doing wrong? Thanks in advance Cheers Dulux-Oz
Hello, I just used a self sign cert, but it's been a while and remember it pretty much just working. Out of curiosity, what's is ssl_server_port set to? On Sun, 22 Sept 2024, 22:10 , <matthew@peregrineit.net> wrote:
Hi All,
I'm running an (experimental) 3-Node Ceph Reef (v18.2.4) Cluster.
Each of the 3 nodes runs (amongst other services) the Ceph Dashboard - for fail-over purposes.
I can connect to the Ceph Dashboard when not using TLS (ie ceph config set mgr mgr/dashboard/ssl false).
I've got a private PKI (Step-CA) and I'd like to use its TLS Certificates for the Ceph Dashboard.
The private PKI's CA Cert has been added to my browser, and internal websites, etc, using the internal PKI's Certificates work as expected.
I'd like each of the three Ceph Nodes to use their own TLS Certificate. The 3 node's hostnames are ceph01.example.com, ceph02.example.com, and ceph03.example.com.
The 3 node's mgr instances are (I think; & this could be where I'm going wrong) are mgr.ceph01, mgr.ceph02, and mgr.ceph03.
I've created 3 TLS Certificates with names of cephdash-ceph01.example.com.crt, etc, CNs of cephdash-ceph01.example.com, etc, and SANs of ceph01.example.com, etc
I've followed the documentation here: https://docs.ceph.com/en/reef/mgr/dashboard/#ssl-tls-support
I have stopped and restarted the Ceph Dashboard service.
Commands used (on ceph01.example.com):
ceph dashboard set-ssl-certificate ceph01 -i cephdash-ceph01.example.com .crt ceph dashboard set-ssl-certificate-key ceph01 -i cephdash-ceph01.example.com.key ceph mgr module disable dashboard ceph mgr module enable dashboard
It's not working (I get an Unable to connect page), and I can't work out why - but I suspect it'll be something bleedingly obvious. :-)
My Qs:
Can I use EC Certs or must I use RSA Certs? I've tryied both and neither work. Can anyone spot what I'm doing wrong?
Thanks in advance
Cheers
Dulux-Oz _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
Hello, Do you have any kind of firewall rules that could be blocking it? If you do a netstat on your current acting manager, it shows listening? Do you have firewalld running? I don't mean this as an insult, but you are putting https://cephmgr:8443? I've seen browsers not add the s if it's not 443. The only other thing I can think of is, does it work if you use ceph dashboard create-self-signed-cert? Cheers, Curt On Mon, 23 Sept 2024, 06:23 duluxoz, <duluxoz@gmail.com> wrote:
Hi,
ssl_server_port is 8443
On 23/9/24 05:14, Curt wrote:
Hello,
I just used a self sign cert, but it's been a while and remember it pretty much just working. Out of curiosity, what's is ssl_server_port set to?
Hi Curt, Damn! I think I've just worked it out - but I can't check it until tomorrow. I think I haven't opened up 8443 in the firewall. As I said, I'll check tomorrow and report back Thanks for being a "sounding-board". Cheers Dulux-Oz On 23/9/24 18:25, Curt wrote:
Hello,
Do you have any kind of firewall rules that could be blocking it? If you do a netstat on your current acting manager, it shows listening? Do you have firewalld running? I don't mean this as an insult, but you are putting https://cephmgr:8443? I've seen browsers not add the s if it's not 443.
The only other thing I can think of is, does it work if you use ceph dashboard create-self-signed-cert?
Cheers, Curt
On Mon, 23 Sept 2024, 06:23 duluxoz, <duluxoz@gmail.com> wrote:
Hi,
ssl_server_port is 8443
On 23/9/24 05:14, Curt wrote: > > Hello, > > I just used a self sign cert, but it's been a while and remember it > pretty much just working. Out of curiosity, what's is ssl_server_port > set to? >
-- PEREGRINE IT Pty Ltd Signature *Matthew J BLACK* M.Inf.Tech.(Data Comms) MBA B.Sc. MACS (Snr), CP, IP3P When you want it done /right/ ‒ the first time! Phone: +61 4 0411 0089 Email: matthew@peregrineit.net <mailto:matthew@peregrineit.net> Web: www.peregrineit.net <http://www.peregrineit.net> View Matthew J BLACK's profile on LinkedIn <http://au.linkedin.com/in/mjblack> This Email is intended only for the addressee. Its use is limited to that intended by the author at the time and it is not to be distributed without the author’s consent. You must not use or disclose the contents of this Email, or add the sender’s Email address to any database, list, or mailing list unless you are expressly authorised to do so. Unless otherwise stated, PEREGRINE I.T. Pty Ltd accepts no liability for the contents of this Email except where subsequently confirmed in writing. The opinions expressed in this Email are those of the author and do not necessarily represent the views of PEREGRINE I.T. Pty Ltd. This Email is confidential and may be subject to a claim of legal privilege. If you have received this Email in error, please notify the author and delete this message immediately.
Yeap, that was my issue (forgot to open up port 8443 in the firewall) <sheepish grin> Thanks for the help PS Oh, and you *can* use ECC TLS Certs - if anyone wanted to know.
participants (3)
-
Curt
-
duluxoz
-
matthew＠peregrineit.net