Chapter 14. Enabling SSL/TLS on Overcloud Public Endpoints By default, the overcloud uses unencrypted endpoints for its services. This means that the overcloud configuration requires an additional environment file to enable SSL/TLS for its Public API endpoints. The following chapter shows how to configure your SSL/TLS certificate and include it as a part of your overcloud creation. Note This process only enables SSL/TLS for Public API endpoints. The Internal and Admin APIs remain unencrypted. This process requires network isolation to define the endpoints for the Public API. 14.1. Initializing the Signing Host The signing host is the host that generates and signs new certificates with a certificate authority. If you have never created SSL certificates on the chosen signing host, you might need to initialize the host so that it can sign new certificates. The /etc/pki/CA/index.txt file contains records of all signed certificates. Check if this file exists. If the file does not exist, create the directory path if needed, then create an empty file, index.txt : The /etc/pki/CA/serial file identifies the serial number to use for the certificate to sign. Check if this file exists. If the file does not exist, create a new file, serial , with a starting value of 1000 : 14.2. Creating a Certificate Authority Normally you sign your SSL/TLS certificates with an external certificate authority. In some situations, you might want to use your own certificate authority. For example, you might want to have an internal-only certificate authority. Generate a key and certificate pair to act as the certificate authority: The openssl req command asks for certain details about your authority. Enter these details at the prompt. These commands create a certificate authority file called ca.crt.pem . 14.3. Adding the Certificate Authority to Clients For any external clients aiming to communicate using SSL/TLS, copy the certificate authority file to each client that requires access to your Red Hat OpenStack Platform environment. After you copy the certificate authority file to each client, run the following command on each client to add the certificate to the certificate authority trust bundle: For example, the undercloud requires a copy of the certificate authority file so that it can communicate with the overcloud endpoints during creation. 14.4. Creating an SSL/TLS Key Run the following commands to generate the SSL/TLS key ( server.key.pem ) that you use at different points to generate your undercloud or overcloud certificates: 14.5. Creating an SSL/TLS Certificate Signing Request This procedure creates a certificate signing request for the overcloud. Copy the default OpenSSL configuration file for customization. Edit the custom openssl.cnf file and set SSL parameters to use for the overcloud. An example of the types of parameters to modify include: Set the commonName_default to one of the following: If using an IP to access over SSL/TLS, use the Virtual IP for the Public API. Set this VIP using the PublicVirtualFixedIPs parameter in an environment file. For more information, see Section 13.4, "Assigning Predictable Virtual IPs" . If you are not using predictable VIPs, the director assigns the first IP address from the range defined in the ExternalAllocationPools parameter. If using a fully qualified domain name to access over SSL/TLS, use the domain name instead. Include the same Public API IP address as an IP entry and a DNS entry in the alt_names section. If also using DNS, include the hostname for the server as DNS entries in the same section. For more information about openssl.cnf , run man openssl.cnf . Run the following command to generate certificate signing request ( server.csr.pem ): Make sure to include the SSL/TLS key you created in Section 14.4, "Creating an SSL/TLS Key" for the -key option. Use the server.csr.pem file to create the SSL/TLS certificate in the section. 14.6. Creating the SSL/TLS Certificate Run the following command to create a certificate for your undercloud or overcloud: This command uses the following options: The configuration file specifying the v3 extensions. Include the configuration file with the -config option. The certificate signing request from Section 14.5, "Creating an SSL/TLS Certificate Signing Request" to generate and sign the certificate with a certificate authority. Include the certificate signing request with the -in option. The certificate authority you created in Section 14.2, "Creating a Certificate Authority" , which signs the certificate. Include the certificate authority with the -cert option. The certificate authority private key you created in Section 14.2, "Creating a Certificate Authority" . Include the private key with the -keyfile option. This command creates a new certificate named server.crt.pem . Use this certificate in conjunction with the SSL/TLS key from Section 14.4, "Creating an SSL/TLS Key" to enable SSL/TLS. 14.7. Enabling SSL/TLS Copy the enable-tls.yaml environment file from the Heat template collection: Edit this file and make the following changes for these parameters: SSLCertificate Copy the contents of the certificate file ( server.crt.pem ) into the SSLCertificate parameter. For example: Important The certificate contents require the same indentation level for all new lines. SSLIntermediateCertificate If you have an intermediate certificate, copy the contents of the intermediate certificate into the SSLIntermediateCertificate parameter: Important The certificate contents require the same indentation level for all new lines. SSLKey Copy the contents of the private key ( server.key.pem ) into the SSLKey parameter. For example: Important The private key contents require the same indentation level for all new lines. 14.8. Injecting a Root Certificate If the certificate signer is not in the default trust store on the overcloud image, you must inject the certificate authority into the overcloud image. Copy the inject-trust-anchor-hiera.yaml environment file from the heat template collection: Edit this file and make the following changes for these parameters: CAMap Lists each certificate authority content (CA) to inject into the overcloud. The overcloud requires both a CA files used to sign the certificates for the undercloud and the overcloud. Copy the contents of the root certificate authority file ( ca.crt.pem ) into an entry. For example, your CAMap parameter might look like the following: Important The certificate authority contents require the same indentation level for all new lines. You can also inject additional CAs with the CAMap parameter. 14.9. Configuring DNS endpoints If using a DNS hostname to access the overcloud through SSL/TLS, you will need to copy the custom-domain.yaml file into /home/stack/templates . You can find this file in /usr/share/tripleo-heat-templates/environments/predictable-placement/ . Configure the host and domain names for all fields, adding parameters for custom networks if needed: Note It is not possible to redeploy with a TLS-everywhere architecture if this environment file is not included in the initial deployment. Add a list of DNS servers to use under parameter defaults, in either a new or existing environment file: 14.10. Adding Environment Files During Overcloud Creation The deployment command ( openstack overcloud deploy ) uses the -e option to add environment files. Add the environment files from this section in the following order: The environment file to enable SSL/TLS ( enable-tls.yaml ) The environment file to set the DNS hostname ( cloudname.yaml ) The environment file to inject the root certificate authority ( inject-trust-anchor-hiera.yaml ) The environment file to set the public endpoint mapping: If using a DNS name for accessing the public endpoints, use /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml If using a IP address for accessing the public endpoints, use /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml For example: 14.11. Updating SSL/TLS Certificates If you need to update certificates in the future: Edit the enable-tls.yaml file and update the SSLCertificate , SSLKey , and SSLIntermediateCertificate parameters. If your certificate authority has changed, edit the inject-trust-anchor.yaml file and update the SSLRootCertificate parameter. Once the new certificate content is in place, rerun your deployment command. For example:

Commands:
mkdir -p /etc/pki/CA sudo touch /etc/pki/CA/index.txt
echo '1000' | sudo tee /etc/pki/CA/serial
openssl genrsa -out ca.key.pem 4096 openssl req -key ca.key.pem -new -x509 -days 7300 -extensions v3_ca -out ca.crt.pem
sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract
openssl genrsa -out server.key.pem 2048
cp /etc/pki/tls/openssl.cnf .
[req] distinguished_name = req_distinguished_name req_extensions = v3_req [req_distinguished_name] countryName = Country Name (2 letter code) countryName_default = AU stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Queensland localityName = Locality Name (eg, city) localityName_default = Brisbane organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = Red Hat commonName = Common Name commonName_default = 10.0.0.1 commonName_max = 64 Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] IP.1 = 10.0.0.1 DNS.1 = 10.0.0.1 DNS.2 = myovercloud.example.com
openssl req -config openssl.cnf -key server.key.pem -new -out server.csr.pem
sudo openssl ca -config openssl.cnf -extensions v3_req -days 3650 -in server.csr.pem -out server.crt.pem -cert ca.crt.pem -keyfile ca.key.pem
cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml ~/templates/.
parameter_defaults: SSLCertificate: | -----BEGIN CERTIFICATE----- MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGS sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQ -----END CERTIFICATE-----
parameter_defaults: SSLIntermediateCertificate: | -----BEGIN CERTIFICATE----- sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvpBCwUAMFgxCzAJB MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQE -----END CERTIFICATE-----
parameter_defaults: SSLKey: | -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAqVw8lnQ9RbeI1EdLN5PJP0lVO ctlKn3rAAdyumi4JDjESAXHIKFjJNOLrBmpQyES4X -----END RSA PRIVATE KEY-----
cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor-hiera.yaml ~/templates/.
parameter_defaults: CAMap: undercloud-ca: content: | -----BEGIN CERTIFICATE----- MIIDlTCCAn2gAwIBAgIJAOnPtx2hHEhrMA0GCS BAYTAlVTMQswCQYDVQQIDAJOQzEQMA4GA1UEBw UmVkIEhhdDELMAkGA1UECwwCUUUxFDASBgNVBA -----END CERTIFICATE----- overcloud-ca: content: | -----BEGIN CERTIFICATE----- MIIDBzCCAe+gAwIBAgIJAIc75A7FD++DMA0GCS BAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xOTAxMz Um54yGCARyp3LpkxvyfMXX1DokpS1uKi7s6CkF -----END CERTIFICATE-----
title: Custom Domain Name description: | This environment contains the parameters that need to be set in order to use a custom domain name and have all of the various FQDNs reflect it. parameter_defaults: # The DNS domain used for the hosts. This must match the overcloud_domain_name configured on the undercloud. # Type: string CloudDomain: localdomain # The DNS name of this cloud. E.g. ci-overcloud.tripleo.org # Type: string CloudName: overcloud.localdomain # The DNS name of this cloud's provisioning network endpoint. E.g. 'ci-overcloud.ctlplane.tripleo.org'. # Type: string CloudNameCtlplane: overcloud.ctlplane.localdomain # The DNS name of this cloud's internal_api endpoint. E.g. 'ci-overcloud.internalapi.tripleo.org'. # Type: string CloudNameInternal: overcloud.internalapi.localdomain # The DNS name of this cloud's storage endpoint. E.g. 'ci-overcloud.storage.tripleo.org'. # Type: string CloudNameStorage: overcloud.storage.localdomain # The DNS name of this cloud's storage_mgmt endpoint. E.g. 'ci-overcloud.storagemgmt.tripleo.org'. # Type: string CloudNameStorageManagement: overcloud.storagemgmt.localdomain
parameter_defaults: DnsServers: ["10.0.0.254"] .
openstack overcloud deploy --templates [...] -e /home/stack/templates/enable-tls.yaml -e ~/templates/cloudname.yaml -e ~/templates/inject-trust-anchor-hiera.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml
openstack overcloud deploy --templates [...] -e /home/stack/templates/enable-tls.yaml -e ~/templates/cloudname.yaml -e ~/templates/inject-trust-anchor.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml