README.md

TLS and Certificates

This document explains how to handle TLS certificates for the feed key service.

The service uses rustls internally to handle the TLS connections.

• Certificate Generation
  • Server Certificates Quick Start
  • Server Certificates with CA
  • Client Certificates with CA
• Setup TLS
• Setup mTLS
• View Content of Certificates
  • Server Private Key
  • Server Certificate
  • Server Certificate Signing Request (CSR)
  • Client Private Key
  • Client Certificate
  • Client Certificate Signing Request (CSR)

Certificate Generation

For a local setup it is possible to setup a self-signed certificate chain which requires the openssl command to be installed.

Server Certificates Quick Start

A self-signed TLS server private key and server certificate for testing purposes can be generated with the following command easily

openssl req -newkey rsa:4096 -noenc -keyout server.key -x509 -days 365 -out server.cert.pem -subj "/CN=ACME" -batch

Server Certificates with CA

Create CA private key and certificate (if not already created).

./ca-certificates.sh

Create server private key and certificate that is signed by the CA

./server-certificates.sh

Client Certificates with CA

Create CA private key and certificate (if not already created).

./ca-certificates.sh

Create client private key and certificate that is signed by the CA

./client-certificates.sh

Setup TLS

Via CLI

greenbone-feed-key --tls-server-key ./certs/server.key --tls-server-cert ./certs/server.cert.pem

Via Environment Variables

export GREENBONE_FEED_KEY_TLS_SERVER_KEY=./certs/server.key
export GREENBONE_FEED_KEY_TLS_SERVER_CERT=./certs/server.cert.pem
greenbone-feed-key

Setup mTLS

Setting up mTLS requires providing a root certificate that has signed the actual client certificates.

Via CLI

greenbone-feed-key --tls-server-key ./certs/server.key --tls-server-cert ./certs/server.cert.pem --tls-client-certs ./certs/ca.cert.pem

Via Environment Variables

export GREENBONE_FEED_KEY_TLS_SERVER_KEY=./certs/server.key
export GREENBONE_FEED_KEY_TLS_SERVER_CERT=./certs/server.cert.pem
export GREENBONE_FEED_KEY_TLS_CLIENT_CERTS=./certs/ca.cert.pem
greenbone-feed-key

View Content of Certificates

Server Private Key

openssl rsa -noout -text -in ./server.key

Server Certificate

openssl x509 -noout -text -in ./server.cert.pem

Server Certificate Signing Request (CSR)

openssl req -noout -text -in ./server.csr

Client Private Key

openssl rsa -noout -text -in ./client.key

Client Certificate

openssl x509 -noout -text -in ./client.cert.pem

Client Certificate Signing Request (CSR)

openssl req -noout -text -in ./client.csr