Skip to content

Commit e6a4879

Browse files
MzamankhanMzamankhan
authored
Update concept-default-root-ca.md
1 parent 1f72f00 commit e6a4879

File tree

1 file changed

+59
-65
lines changed

1 file changed

+59
-65
lines changed

‎articles/iot-operations/manage-mqtt-broker/concept-default-root-ca.md

Lines changed: 59 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,85 @@
11
---
2-
title: Azure IoT Operations Preview default root CA and issuer for TLS server certificates
3-
description: Azure IoT Operations Preview has a default root CA and issuer for TLS server certificates to help you get started with secure communication between the MQTT broker and client.
2+
title: Certificate management for AIO internal communication
3+
description: Azure IoT Operations Preview uses TLS to encrypt communication. Learn about the default set up and also how to bring your own CA for production usecase.
44
author: PatAltimore
55
ms.author: patricka
66
ms.subservice: azure-mqtt-broker
77
ms.topic: concept-article
88
ms.date: 09/09/2024
99

10-
#CustomerIntent: As an operator, I want to configure MQTT broker to use TLS so that I have secure communication between the MQTT broker and client.
10+
#CustomerIntent: As an operator, I want to configure AIO components to use TLS so that I have secure communication between all components.
1111
---
1212

13-
# Default root CA and issuer for TLS server certificates
13+
# Certificate management for AIO internal communication
1414

15-
To help you get started, Azure IoT Operations Preview is deployed with a default *quickstart* root CA and issuer for TLS server certificates. You can use this issuer for development and testing.
15+
All communication within AIO communications is encrypted using TLS. To help you get started, Azure IoT Operation is deployed with a default root CA and issuer for TLS server certificates. The default set up can be used for development and testing purposes. For production deployment, it is recommended to bring in your own CA issuer and use an enterprise PKI solution.
1616

17-
* The CA certificate is self-signed and not trusted by any clients outside of Azure IoT Operations. The subject of the CA certificate is `CN = Azure IoT Operations Quickstart Root CA - Not for Production` and it expires in 30 days from the time of installation.
17+
## Default root CA and issuer for TLS server certificates
1818

19-
* The root CA certificate is stored in a Kubernetes secret called `aio-ca-key-pair-test-only`.
19+
To help you get started, Azure IoT Operations Preview is deployed with a default root CA and issuer for TLS server certificates. You can use this issuer for development and testing. Azure IoT Operations uses [cert-manager](https://cert-manager.io/docs/) to manage TLS certificates, and [trust-manager](https://cert-manager.io/docs/trust/) to distribute trust bundles to components.
2020

21-
* The public portion of the root CA certificate is stored in a ConfigMap called `aio-ca-trust-bundle-test-only`. You can retrieve the CA certificate from the ConfigMap and inspect it with kubectl and openssl.
21+
* The CA certificate is self-signed and not trusted by any clients outside of Azure IoT Operations. The subject of the CA certificate is `CN=Azure IoT Operations Quickstart Root CA - Not for Production`. The CA certificate is automatically rotated by cert-manager.
22+
23+
* The root CA certificate certificate is stored in a Kubernetes secret called `azure-iot-operations-aio-ca-certificate` under the `cert-manager` namespace.
24+
25+
* The public portion of the root CA certificate is stored in a ConfigMap called `azure-iot-operations-aio-ca-trust-bundle` under the `azure-iot-operations` namespace. You can retrieve the CA certificate CA certificate from the ConfigMap and inspect it with kubectl and openssl. The ConfigMap is kept updated by trust-manager when the CA certificate is rotated by cert-manager.
2226

2327
```bash
24-
kubectl get configmap aio-ca-trust-bundle-test-only -n azure-iot-operations -o json | jq -r '.data["ca.crt"]' | openssl x509 -text -noout
28+
kubectl get configmap azure-iot-operations-aio-ca-trust-bundle -n azure-iot-operations -o "jsonpath={.data['ca\.crt']}" | openssl x509 -text -noout
2529
```
2630

2731
```Output
28-
Certificate:
29-
Data:
30-
Version: 3 (0x2)
31-
Serial Number:
32-
<SERIAL-NUMBER>
33-
Signature Algorithm: ecdsa-with-SHA256
34-
Issuer: CN = Azure IoT Operations Quickstart Root CA - Not for Production
35-
Validity
36-
Not Before: Nov 2 00:34:31 2023 GMT
37-
Not After : Dec 2 00:34:31 2023 GMT
38-
Subject: CN = Azure IoT Operations Quickstart Root CA - Not for Production
39-
Subject Public Key Info:
40-
Public Key Algorithm: id-ecPublicKey
41-
Public-Key: (256 bit)
42-
pub:
43-
<PUBLIC-KEY>
44-
ASN1 OID: prime256v1
45-
NIST CURVE: P-256
46-
X509v3 extensions:
47-
X509v3 Basic Constraints: critical
48-
CA:TRUE
49-
X509v3 Key Usage:
50-
Certificate Sign
32+
Certificate:
33+
Data:
34+
Version: 3 (0x2)
35+
Serial Number:
36+
<SERIAL-NUMBER>
37+
Signature Algorithm: sha256WithRSAEncryption
38+
Issuer: O=Microsoft, CN=Azure IoT Operations Quickstart Root CA - Not for Production
39+
Validity
40+
Not Before: Sep 18 20:42:19 2024 GMT
41+
Not After : Sep 18 20:42:19 2025 GMT
42+
Subject: O=Microsoft, CN=Azure IoT Operations Quickstart Root CA - Not for Production
43+
Subject Public Key Info:
44+
Public Key Algorithm: rsaEncryption
45+
Public-Key: (2048 bit)
46+
Modulus: <MODULUS>
47+
Exponent: 65537 (0x10001)
48+
X509v3 extensions:
49+
X509v3 Key Usage: critical
50+
Certificate Sign, CRL Sign
51+
X509v3 Basic Constraints: critical
52+
CA:TRUE
5153
X509v3 Subject Key Identifier:
52-
<SUBJECT-KEY-IDENTIFIER>
53-
Signature Algorithm: ecdsa-with-SHA256
54-
[SIGNATURE]
54+
<SUBJECT-KEY-IDENTIFIER>
55+
Signature Algorithm: sha256WithRSAEncryption
56+
[Signature]
5557
```
56-
57-
* By default, there's already a CA issuer configured in the `azure-iot-operations` namespace called `aio-ca-issuer`. It's used as the common CA issuer for all TLS server certificates for IoT Operations. MQTT broker uses an issuer created from the same CA certificate to issue TLS server certificates for the default TLS listener on port 18883. You can inspect the issuer with the following command:
58+
59+
* By default, there's already a CA issuer configured in the `azure-iot-operations namespace` called `azure-iot-operations-aio-certificate-issuer`. It's used as the common CA issuer for all TLS server certificates for IoT Operations. MQTT broker uses an issuer created from the same CA certificate to issue TLS server certificates for the default TLS listener on port 18883. You can inspect the issuer with the following command:
5860

5961
```bash
60-
kubectl get issuer aio-ca-issuer -n azure-iot-operations -o yaml
62+
kubectl get clusterissuer azure-iot-operations-aio-certificate-issuer -o yaml
6163
```
6264

6365
```Output
64-
apiVersion: cert-manager.io/v1
65-
kind: Issuer
66-
metadata:
67-
annotations:
68-
meta.helm.sh/release-name: azure-iot-operations
69-
meta.helm.sh/release-namespace: azure-iot-operations
70-
creationTimestamp: "2023-11-01T23:10:24Z"
71-
generation: 1
72-
labels:
73-
app.kubernetes.io/managed-by: Helm
74-
name: aio-ca-issuer
75-
namespace: azure-iot-operations
76-
resourceVersion: "2036"
77-
uid: <UID>
78-
spec:
79-
ca:
80-
secretName: aio-ca-key-pair-test-only
81-
status:
82-
conditions:
83-
- lastTransitionTime: "2023-11-01T23:10:59Z"
84-
message: Signing CA verified
85-
observedGeneration: 1
86-
reason: KeyPairVerified
87-
status: "True"
88-
type: Ready
66+
apiVersion: cert-manager.io/v1
67+
kind: ClusterIssuer
68+
metadata:
69+
creationTimestamp: "2024-09-18T20:42:17Z"
70+
generation: 1
71+
name: azure-iot-operations-aio-certificate-issuer
72+
resourceVersion: "36665"
73+
uid: 592700a6-95e0-4788-99e4-ea93934bd330
74+
spec:
75+
ca:
76+
secretName: azure-iot-operations-aio-ca-certificate
77+
status:
78+
conditions:
79+
- lastTransitionTime: "2024-09-18T20:42:22Z"
80+
message: Signing CA verified
81+
observedGeneration: 1
82+
reason: KeyPairVerified
83+
status: "True"
84+
type: Ready
8985
```
90-
91-
For production, you must configure a CA issuer with a certificate from a trusted CA, as described in [Configure TLS with automatic certificate management to secure MQTT communication in MQTT broker](howto-configure-tls-auto.md).

0 commit comments

Comments
 (0)