784716 - Document CA management in AWS

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P2)

Comment 1

[Rail Aliiev [:rail]]

Attachment: CA scripts

Almost 100% copy of the scripts used for releng puppetagain master.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 661856 [details] [diff] [review]
CA scripts

Review of attachment 661856 [details] [diff] [review]:
-----------------------------------------------------------------

How are you handling creation of the master host certificates?

This looks good - commit with minor tweaks.  Thanks for documenting this!

::: setup/ca-scripts/README
@@ +1,3 @@
> += Scripts used for puppet certificate generation =
> +
> +== Installation ==

A little explanation of what's going on here might help - you're generating a CA certificate which is then used to manually sign client certificates, right?

@@ +8,5 @@
> + mkdir /var/lib/puppet/ssl-master
> + cd /var/lib/puppet/ssl-master
> + mkdir -p ca/{private,certs} certdir client_certs/revoke
> + touch ca/inventory.txt
> + RANDOM=$$ printf "%X\n" $RANDOM > ca/serial

Why a random serial?  This is usually just '1'.  Is there a benefit to using RANDOM here?

@@ +19,5 @@
> +  chmod 400
> +
> + openssl req  -new -newkey rsa:2048 -keyout ca/ca_key.pem \
> +   -days 3650 -x509 -out ca/ca_crt.pem \
> +   -subj '/C=US/ST=California/L=San Francisco/O=Mozilla Corporation/OU=Releng/CN=ca.build.mozilla.org/emailAddress=[e-mail]'

As it turns out, you actually don't want slashes here, because puppet >= 2.7.18 chokes on them.  I think you could get away with just a string here.

@@ +29,5 @@
> +== Usage ==
> +"generate-cert.sh $hostname $output_directory" will generate a certificate for
> +$hostname and put all needed files into $output_directory.
> +
> +== How to generatate force update CRL ==

Doesn't this happen automatically?  I'm not sure what you mean by "generate force update" - that's three verbs in a row :)

Comment 3

[Rail Aliiev [:rail]]

Comment on attachment 661856 [details] [diff] [review]
CA scripts

http://hg.mozilla.org/build/puppet/rev/f681ac33b2ea

(In reply to Dustin J. Mitchell [:dustin] from comment #2)
> How are you handling creation of the master host certificates?

They are generated by the same script. No difference between servers and agents.

http://hg.mozilla.org/build/cloud-tools/file/f78ed83ff199/aws/aws_create_instance.py#l68
vs
http://hg.mozilla.org/build/cloud-tools/file/f78ed83ff199/aws/aws_create_puppetmaster.py#l106

 
> A little explanation of what's going on here might help - you're generating
> a CA certificate which is then used to manually sign client certificates,
> right?

Yeah, I renamed the section below to "CA Setup" and added a brief explanation.

> Why a random serial?  This is usually just '1'.  Is there a benefit to using
> RANDOM here?

The main idea was using a hex value instead of decimal (which is default). IIRC, in this case you can generate moar certificates! I dropped RANDOM and replaced it with:

 echo "0x1" > ca/serial
 
> As it turns out, you actually don't want slashes here, because puppet >=
> 2.7.18 chokes on them.  I think you could get away with just a string here.


Oooh... Does this mean that I should edit the existing CA cert and replace slashes with something else (comas?)?

> Doesn't this happen automatically?  I'm not sure what you mean by "generate
> force update" - that's three verbs in a row :)

It happens automatically when you $need_crl is set to true, which is not the case when you generate first certificates (but you need the CRL file to make puppet masters work properly). I added the following check:

if [ ! -e "$crl" ]; then
    need_crl=true
fi

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

I'm not sure what the restrictions on subject name are - I need to figure that out before submitting an updated patch upstream.  Changing your existing CA would make all of the existing certs invalid, so that's probably no fun.

Comment 5

[Rail Aliiev [:rail]]

OK, I'll keep that in mind.

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

BTW, it turns out OpenSSL requires the slashes.  Puppet won't allow them, though.  Fun.

Comment 7

[Rail Aliiev [:rail]]

(In reply to Dustin J. Mitchell [:dustin] from comment #6)
> BTW, it turns out OpenSSL requires the slashes.  Puppet won't allow them,
> though.  Fun.

Sooooo great! :)