options for mutual TLS

[epackorigan]

New options SSLClientCertificate and SSLClientKey to allow curl to do mutual TLS connection to the server.

• the URL must be using TLS (https://*)
• you can use one of the following:
  • an alias for the name of a certificate/key pair in the system/user keychain (and provide a password for the key if needed)
  • a PKCS12 bundle and a password /path/to/file.p12:password
  • a key and certificate in PEM format.

See man page for curl, specifically, --key, --cert, --key-type, --cert-type.

This is, as of yet, untested...

[grahamgilbert]

Instructions for setting up a server so this can be validated would be appreciated.

[epackorigan]

Find below a config for HA Proxy to do the SSL termination+auth as a frontend to the sal server.

haproxy.cfg: `global log 127.0.0.1 local0 notice maxconn 2000 user haproxy group haproxy

defaults log global mode http option httplog option dontlognull retries 3 option redispatch timeout connect 5000 timeout client 10000 timeout server 10000

frontend https-sal-scripts bind *:443 ssl crt [crt_chain.pem] ca-file [cafile.pem] verify required mode tcp default_backend sal-nodes

backend sal-nodes mode tcp balance roundrobin server [beserver] [192.168.10.11] check ssl verify required ca-file [/etc/haproxy/myca.pem] `

replace the item in [] items as needed:

• crt_chain.pem: name of the file containing the key + cert concatenated for HA proxy to present to the client (it can include the chain if needed for the client).
• cafile.pem: Name of the file containing the certificate(s) to verify client-side SSL certificates against (concatenate as needed if verifying against more than one CA should work)
• beserver1: name of backend server(s). duplicate line as needed, if you have more than one backend.
• 192.168..: IP address to use for those servers.
• /etc/haproxy/myca.pem: is the issuing certitificate to verify the backend SSL certificate when connecting to it.

[grahamgilbert]

I do not have time to test this. If you can provision a pre-built docker image so this can be tested, I may be happy to merge this. At the moment with no simple way to test, I cannot merge this.

[epackorigan]

Fair enough - I'm new to docker, so this may take a while.

[grahamgilbert]

As this doesn’t break any existing functionality I’m going to merge this. Hopefully more people using it will help surface any issues.

[grahamgilbert]

Can you please document the use of this in the main Sal wiki?

[epackorigan]

Documentation updated. Let me know if it needs further clarification.