Package: chainsmith
ChainSmithTL;DRPlease see [QUICKSTART.md] to get started immediately.Why use ChainSmithIf you want to run Postgres and other tools Enterprise grade you want to use SSL for encryption in transit, and verifying trust.
But creating a simple chain with a root, 2 intermediates, client certificates and/or server certificates is a very complex procedure requirying much manual effort.
This project is meant to fix this.With ChainSmith, you can easily define a chain in yaml config, and then run this script to create a root ca, intermediates and signed certificates.
All tar files are bundled in separate yaml files, so you can easily use them in tools like Ansible for deployment.
Or, if you do want externally signed certificates, you can use ChainSmith to generate all CSR's to be signed externally.
And you can run with the generated chain until the externally signed certificates are available.ChainSmith is a crucial piece into improving adoption of running Postgres and other tools with proper security.
And as such systems can be easily equipped with the proper certificate chains so that secure communication and authorization is possible.UsageInstallationPlease see [QUICKSTART.md] for options to install and run chainsmith.ConfigAn example config file chainsmith.yml is shipped with chainsmith.
Change as required and run chainsmith.chainsmith -c /PATH/TO/CONFIG/chainsmith.ymlFor more options, seechainsmith --helpNotethat by default the certificates are written as a yaml hash to stdout, and the private keys are written as a yal hash to stderr.
Alternatively you can redirect them to files using the-oand-poptions.Why use certificatesCertificates are a technical implementation for verification of trustworthiness.
Certificates can be verified on the following points:to be used for its correct purposeto be used by the correct person or systemto be used by a person or system which is trusted by you, or a party you trust
Once trustworthiness is established, certificates can be used to limit communication to only the 2 parties that are communicating.How verification of trust worksA certificate can be verified to:be used for its proper purposecommon name should correspond to the server you are communicating with, orcommon name should correspond to the user trying to authenticate with itbe used by the proper system or userthe certificate can be shared to everyone that wants to be verified, butthe certificate can only be used by those that hold the corresponding private keybe handed out by someone or something you trust, or someone they trustEvery certificate is signed by another certificate (except for root certificates)Before signing off on a certificate, the authority is required to properly verify that the certificate is requested by the proper person, system or authoritythis creates a chain of trustif you can trust one certificate in the chain, you can also trust all that are signed by that certificateCertificates that can no longer be trusted can be revokedOnce trust is verified, communication is assured to be protected from anyone besides the 2 parties that are communicatingall information encrypted with the certificate can only be decrypted by the system or person with the correct private keyDevelopmentThis project is maintained ongithub.If you run into issues while using, or you may have other suggestions to improve ChainSmith, please create anIssue.And if you want to contribute, don't be shy, just create aPull Requestand we will probably merge.LicenseThis software (all code in this github project) is subjective to GNU GENERAL PUBLIC LICENSE version 3.