Skip to content

Latest commit

 

History

History
65 lines (59 loc) · 2.29 KB

ldap-failover-generate-certs.adoc

File metadata and controls

65 lines (59 loc) · 2.29 KB

Generating and sharing certificates with the remote basic authentication server

Complete the following steps on the first master host listed in the Ansible host inventory file, by default /etc/ansible/hosts.

Procedure

  1. To ensure that communication between the remote basic authentication server and {product-title} is trustworthy, create a set of Transport Layer Security (TLS) certificates to use during the other phases of this set up. Run the following command:

    # openshift start \
    --public-master=https://openshift.example.com:8443 \
    --write-config=/etc/origin/

    The output inclues the /etc/origin/master/ca.crt and /etc/origin/master/ca.key signing certificates.

  2. Use the signing certificate to generate keys to use on the remote basic authentication server:

    # mkdir -p /etc/origin/remote-basic/
# oc adm ca create-server-cert \
    --cert='/etc/origin/remote-basic/remote-basic.example.com.crt' \
    --key='/etc/origin/remote-basic/remote-basic.example.com.key' \
    --hostnames=remote-basic.example.com \ (1)
    --signer-cert='/etc/origin/master/ca.crt' \
    --signer-key='/etc/origin/master/ca.key' \
    --signer-serial='/etc/origin/master/ca.serial.txt'

    1. A comma-separated list of all the host names and interface IP addresses that must access the remote basic authentication server.

      Note

      The certificate files that you generate are valid for two years. You can alter this period by changing the --expire-days and --signer-expire-days values, but for security reasons, do not make them greater than 730.
      Important

      If you do not list all host names and interface IP addresses that must access the remote basic authentication server, the HTTPS connection will fail.

  3. Copy the necessary certificates and key to the remote basic authentication server:

    # scp /etc/origin/master/ca.crt \
      [email protected]:/etc/pki/CA/certs/

# scp /etc/origin/remote-basic/remote-basic.example.com.crt \
      [email protected]:/etc/pki/tls/certs/

# scp /etc/origin/remote-basic/remote-basic.example.com.key \
      [email protected]:/etc/pki/tls/private/