Preparing Certificates

This section describes how to generate and prepare certificates for use with Trove.

Generate CA private key

$ openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
........................................+++++
................................+++++
e is 65537 (0x10001)

Warning

Keep the CA private key in a secure offline location.

Create self-signed CA certificate

$ openssl req -x509 -new -nodes \
    -key ca.key \
    -sha256 \
    -days 365 \
    -subj "/CN=Trove Test CA" \
    -out ca-cert.crt

Generate server private key

$ openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
........................................+++++
........................+++++
e is 65537 (0x10001)

Generate server CSR

$ openssl req -new \
    -key server.key \
    -out server.csr \
    -subj "/CN=db.example.com" \
    -addext "subjectAltName=DNS:db.example.com,DNS:db.internal,IP:10.0.0.10"

Note

Please note that domain name and (or) IP address must match the real IP address that your client will use for connection to DB server.

Sign server certificate with CA

$ openssl x509 -req \
    -in server.csr \
    -CA ca-cert.crt \
    -CAkey ca.key \
    -CAcreateserial \
    -out server.crt \
    -days 365 \
    -sha256
Signature ok
subject=/CN=db.example.com
Getting CA Private Key

Create PKCS#12 container

$ openssl pkcs12 -export \
    -inkey server.key \
    -in server.crt \
    -certfile ca-cert.crt \
    -passout pass:MySecretPassword01! \
    -out server.p12

Store PKCS#12 password in Barbican

$ openstack secret store --name my-password-for-pkcs12 \
    --payload MySecretPassword01!
+---------------+----------------------------------------------------------------------------------+
| Field         | Value                                                                            |
+---------------+----------------------------------------------------------------------------------+
| Secret href   | https://barbican-api.example.com/v1/secrets/f54bc745-00e7-4e42-bd6a-0e80879b62f6 |
| Name          | my-password-for-pkcs12                                                           |
| Created       | None                                                                             |
| Status        | None                                                                             |
| Content types | None                                                                             |
| Algorithm     | aes                                                                              |
| Bit length    | 256                                                                              |
| Secret type   | opaque                                                                           |
| Mode          | cbc                                                                              |
| Expiration    | None                                                                             |
+---------------+----------------------------------------------------------------------------------+

Upload PKCS#12 to Barbican

$ openstack secret store --file server.p12 \
    --name my-pkcs12-container-for-ssl \
    --secret-type certificate
+---------------+----------------------------------------------------------------------------------+
| Field         | Value                                                                            |
+---------------+----------------------------------------------------------------------------------+
| Secret href   | https://barbican-api.example.com/v1/secrets/c3fd1238-7d85-4eec-8e36-53c4953bab39 |
| Name          | my-pkcs12-container-for-ssl                                                      |
| Created       | None                                                                             |
| Status        | None                                                                             |
| Content types | None                                                                             |
| Algorithm     | aes                                                                              |
| Bit length    | 256                                                                              |
| Secret type   | certificate                                                                      |
| Mode          | cbc                                                                              |
| Expiration    | None                                                                             |
+---------------+----------------------------------------------------------------------------------+

Create client certificate for mTLS authentication

Generate client private key

$ openssl genrsa -out client.key 2048

Generate client CSR

$ openssl req -new \
    -key client.key \
    -out client.csr \
    -subj "/CN=dbuser"

Note

Please note that subject should be equal to a real user name used to connect to the database.

Sign client certificate

$ openssl x509 -req \
   -in client.csr \
   -CA ca-cert.crt \
   -CAkey ca.key \
   -CAcreateserial \
   -out client.crt \
   -days 365 \
   -sha256

PostgreSQL connection using client certificate

psql "sslmode=verify-full \
      sslrootcert=ca-cert.crt \
      sslcert=client.crt \
      sslkey=client.key \
      host=10.0.0.10 user=dbuser dbname=test_db"