Ensure SSL/TLS processes have correct configuration and are clear to use

[seanshahkarami]

There is currently a tool on beehive for creating SSL/TLS credentials for servers and clients, however, it seems that it's pretty mysterious to most of us.

It would be great if we confirmed that it's creating credentials with the correct configuration (for example, reasonable names, domains, etc and thing like ensuring certificates are signed using SHA256 instead of SHA1). Further, it's important that everyone has a basic understanding of how this process works. We should get things to the point that it's easy to create server credentials for development or testing if we need.

[seanshahkarami]

I think we should eventually move towards a design where the main CA credentials don't have to be on beehive at all... The minimal, correct credentials should be transferred during server provisioning.

This also allows us to ensure that the CA private key is stored on a separate, secure system that's backed up automatically.

[seanshahkarami]

I'm having a hard time getting the waggleca tool to run correctly on my own machine. I'm able to generate certificates fine using: https://github.com/seanshahkarami/testca

I'll look at what's needed to make the waggleca tool more generally available outside of beehive.

[geeklair]

very good idea to keep the CA off beehive and some place with an air gap. Beehive could be loaded with a couple hundred provisioned creditionals to hand out when new nodes connect. -Pete

…

--- Pete Beckman Phone: 630-252-9020 Co-Director, Northwestern / Argonne Institute for Science and Engineering Senior Computer Scientist, Argonne National Laboratory

On Sep 8, 2017, at 2:11 PM, Sean Shahkarami ***@***.***> wrote: I think we should eventually move towards a design where the main CA credentials don't have to be on beehive at all... The minimal, correct credentials should be transferred during server provisioning. This also allows us to ensure that the CA private key is stored on a separate, secure system that's backed up automatically. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#42 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMOVvxdP23Y8HV5-EYwvz-3JNmrjdeMUks5sgZFSgaJpZM4PPw5L>.

[seanshahkarami]

I agree with keeping it off the deployed server. There are also designs where you have the root CA sign sub-CAs which could also do signing. But, I think there are other options for node credentials we may want to think about before putting in much time in rebuilding the CA chain. Maybe..?