Step by actual step guide for external certificates?

[fthiesse]

Is there a step by actual step guide available somewhere? It doesn't even need to be in the official docs (although it should be).

Guess I'm looking for actual examples after spending too many hours trying to get this working.

My config is pretty simple:

pki_default_realms: [] pki_inventory_groups: [ 'test' ] pki_realms:

• name: test

realms
│   ├── by-group
│   │   └── test
│   │       ├── test
│   │       │   ├── external
│   │       │   │   ├── cert.pem
│   │       │   │   ├── intermediate.pem
│   │       │   │   └── root.pem
│   │       │   └── private
│   │       │       └── key.pem

And yet it treats it as internal and creates requests etc. Any pointers?

[drybjed]

To disable the internal certificates, you need to set the pki_internal: False variable for a given host. With this, Ansible won't generate certificate requests for the internal CA, and they won't be signed.

Are your external certs/private key copied to the hosts in the test inventory group? You should see a test PKI realm on these hosts.

[fthiesse]

Setting pki_internal: False on the host disables internal cert signing. I then end up with a selfsigned one. Is this really per host? If the whole realm is external, shouldn't that disable internal/acme/selfsigned for that realm? I believe I'm missing something here.

How would you go about mixed environments? My final setup would include multiple internal and external realms. Hosts would be in one or multiple inventory groups belonging to those realms.

The external certs/private key aren't copied. They are not on the host in the test inventory group.

[drybjed]

First of all, each PKI realm supports separate set of external/acme/internal/selfsigned certificates, in that order, all using the same private key. The pki-realm script detects if external certificates are available, and enables them if they are; otherwise selfsigned will be used. This because services usually expect some kind of X.509 certs/keys available, otherwise they won't start. Even if you have internal CA enabled, if you provide external certificates/private key, they should take precedence.

Now, for the external certificates and private keys, they work slightly differently depending on the inventory level (all, group, host). First, host-based files are copied to the remote hosts. After that, group and all files are copied, only if there are no files already in place - this is so that you can provide for example external certificates for all hosts, but also add a different set for a specific host - this way that specific set will take precedence and won't be overriden.

In your case, you are using a group level certificates/private keys. If you tried to enable it after the PKI realm was created, there might be a cert/private key mismatch. Remove the PKI realm directory on the remote host and try running debops.pki again. Afterwards, show the output of tree /etc/pki/realms/ here, let's see what you get.

[fthiesse]

I've been removing the pki directory on the remote host between every try already. This is what I end up with after a clean run:

tree pki/
pki/
├── hooks
└── realms
    └── test
        ├── acme
        │   ├── account_key.pem
        │   ├── openssl.conf
        │   └── request.pem
        ├── CA.crt -> public/root.pem
        ├── config
        │   └── realm.conf
        ├── default.crt -> public/cert.pem
        ├── default.key -> private/key.pem
        ├── default.pem -> private/key_chain.pem
        ├── external
        ├── internal
        ├── private
        │   ├── key_chain.pem
        │   ├── key.pem
        │   └── realm_key.pem
        ├── public
        │   ├── cert.pem -> ../selfsigned/cert.pem
        │   ├── cert.pem.sig
        │   └── root.pem -> ../selfsigned/root.pem
        ├── selfsigned
        │   ├── cert.pem
        │   ├── gnutls.conf
        │   ├── request.pem
        │   └── root.pem -> cert.pem
        └── trusted.crt -> public/root.pem

10 directories, 19 files

[drybjed]

Hmm, weird... Could you show the debops.pki run as well? I'm interested in Download private realm contents * and Download external realm contents * tasks.

[fthiesse]

TASK [debops.pki : Download private realm contents by host] **** ok: [hostname] => (item={u'name': u'test'})

TASK [debops.pki : Download private realm contents by group] ***

TASK [debops.pki : Download private realm contents for all hosts] ** ok: [hostname] => (item={u'name': u'test'})

---

TASK [debops.pki : Download external realm contents by group] **

TASK [debops.pki : Download external realm contents for all hosts] ***** ok: [hostname] => (item={u'name': u'test'})

[drybjed]

Is that host included in the [test] Ansible inventory group? Otherwise I'm not really sure what's happening. I suppose that we could maybe do a TeamViewer session so I could see what are you trying to do, any chance for that? Can you come over to IRC so we could talk more real-time?

[fthiesse]

Sorted via IRC, the issue came down to using pki_realms: instead of pki_group_realms. Thank you drybjed!