cephadm rgw ssl certificate config
Hi, I came across [1] and wanted to try to have all certificates/keys in one file. But it appears that the validation happens only against the first cert. So what I did was to concatenate all certs/keys into one file, then added that to ceph: ceph config-key set rgw/cert/rgw.realm.zone -i all-hosts.cert.pem ceph orch redeploy rgw The daemons pick up the config correctly and start, but running a curl only succeeds for the first in the list: # first host ok curl https://host3.dmain:443 <?xml version="1.0" encoding="UTF-8"?><ListAllMyBucketsResult... # second host fails curl -v https://host4.domain:443 ... * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: [...] CN=host3.domain; emailAddress=[...] * start date: Jul 18 09:59:07 2024 GMT * expire date: Aug 17 09:59:07 2025 GMT * subjectAltName does not match host4.domain * SSL: no alternative certificate subject name matches target host name 'host4.domain' This is still on Pacific 16.2.13 (testing something for a customer). What I tried in a Reef cluster was to set the certs per host by mapping the cert directory into the containers, then changing this config: ceph config set client.rgw.realm.hostname.suffix rgw_frontends "beast ssl_port=443 ssl_certificate=/etc/ceph/mycert.pem" And after restarting the daemon, it seems to work. So my question is, how do you deal with per-host certificates and rgw? Any comments are appreciated. Thanks! Eugen [1] https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/message/F2GXMK6PE2U...
On Thu, Jul 18, 2024 at 10:49:02AM +0000, Eugen Block wrote:
And after restarting the daemon, it seems to work. So my question is, how do you deal with per-host certificates and rgw? Any comments are appreciated.
By not dealing with it, sort of. Since we run our own CA, so I create one certificate with all the names of all the rgw hosts including their IP addressees in the certificate Subject Alt Names(SAN). -- Kai Stian
Thanks, that's what I proposed to the customer as well. They also have their own CA, so it probably shouldn't be a problem to have such a certificate as well. Thanks! Zitat von Kai Stian Olstad <ceph+list@olstad.com>:
On Thu, Jul 18, 2024 at 10:49:02AM +0000, Eugen Block wrote:
And after restarting the daemon, it seems to work. So my question is, how do you deal with per-host certificates and rgw? Any comments are appreciated.
By not dealing with it, sort of. Since we run our own CA, so I create one certificate with all the names of all the rgw hosts including their IP addressees in the certificate Subject Alt Names(SAN).
-- Kai Stian
The customer got a new certificate with all the DNS names and IPs, we tested it on one host only which was promising. They will restart all the remaining RGWs during their next maintenance window on Wednesday. Thanks! Eugen Zitat von Eugen Block <eblock@nde.ag>:
Thanks, that's what I proposed to the customer as well. They also have their own CA, so it probably shouldn't be a problem to have such a certificate as well.
Thanks!
Zitat von Kai Stian Olstad <ceph+list@olstad.com>:
On Thu, Jul 18, 2024 at 10:49:02AM +0000, Eugen Block wrote:
And after restarting the daemon, it seems to work. So my question is, how do you deal with per-host certificates and rgw? Any comments are appreciated.
By not dealing with it, sort of. Since we run our own CA, so I create one certificate with all the names of all the rgw hosts including their IP addressees in the certificate Subject Alt Names(SAN).
-- Kai Stian
participants (2)
-
Eugen Block
-
Kai Stian Olstad