search

waggle-sensor / beehive-server

Waggle cloud software for aggregation, storage and analysis of sensor data from Waggle nodes.
13 stars 17 forks source link

Ensure SSL/TLS processes have correct configuration and are clear to use #42

Open seanshahkarami opened 6 years ago

seanshahkarami commented 6 years ago

There is currently a tool on beehive for creating SSL/TLS credentials for servers and clients, however, it seems that it's pretty mysterious to most of us.

It would be great if we confirmed that it's creating credentials with the correct configuration (for example, reasonable names, domains, etc and thing like ensuring certificates are signed using SHA256 instead of SHA1). Further, it's important that everyone has a basic understanding of how this process works. We should get things to the point that it's easy to create server credentials for development or testing if we need.

seanshahkarami commented 6 years ago

I think we should eventually move towards a design where the main CA credentials don't have to be on beehive at all... The minimal, correct credentials should be transferred during server provisioning.

This also allows us to ensure that the CA private key is stored on a separate, secure system that's backed up automatically.

seanshahkarami commented 6 years ago

I'm having a hard time getting the waggleca tool to run correctly on my own machine. I'm able to generate certificates fine using: https://github.com/seanshahkarami/testca

I'll look at what's needed to make the waggleca tool more generally available outside of beehive.

geeklair commented 6 years ago

very good idea to keep the CA off beehive and some place with an air gap. Beehive could be loaded with a couple hundred provisioned creditionals to hand out when new nodes connect. -Pete

Pete Beckman Phone: 630-252-9020 Co-Director, Northwestern / Argonne Institute for Science and Engineering Senior Computer Scientist, Argonne National Laboratory

On Sep 8, 2017, at 2:11 PM, Sean Shahkarami notifications@github.com wrote:

I think we should eventually move towards a design where the main CA credentials don't have to be on beehive at all... The minimal, correct credentials should be transferred during server provisioning.

This also allows us to ensure that the CA private key is stored on a separate, secure system that's backed up automatically.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/waggle-sensor/beehive-server/issues/42#issuecomment-328189814, or mute the thread https://github.com/notifications/unsubscribe-auth/AMOVvxdP23Y8HV5-EYwvz-3JNmrjdeMUks5sgZFSgaJpZM4PPw5L.

seanshahkarami commented 6 years ago

I agree with keeping it off the deployed server. There are also designs where you have the root CA sign sub-CAs which could also do signing. But, I think there are other options for node credentials we may want to think about before putting in much time in rebuilding the CA chain. Maybe..?