Configuring OpenStack Identity for SSL communication

One of the many updates to this book will be a more hardened all-around approach. To that end, we begin by enabling SSL communication for services with Keystone by default. It is important to note that we will be doing this via self-signed certificates to illustrate how to configure the services. It is strongly recommended that you acquire the appropriate certificates from a Certificate Authority (CA) for deployment in production.

Getting ready

Ensure that you are logged in to the controller node and that it has Internet access to allow us to install the required packages in our environment for running Keystone. If you created this node with Vagrant, you can execute the following command:

vagrant ssh controller

How to do it...

Carry out the following instructions to configure the Keystone service:

Before we can configure Keystone to use SSL, we need to generate the required OpenSSL Certificates. To do so, log in to the server that is running Keystone and issue the following commands:
```
sudo apt-get install python-keystoneclient
keystone-manage ssl_setup --keystone-user keystone \--keystone-group keystone
```
Tip
The command keystone-manage ssl_setup is not intended for production use. This is a convenient tool for creating self-signed certificates for Keystone.
Once our certificates are generated, we can use them when communicating with our Keystone service. We can refer to the generated CA file for our other services by placing this in an accessible place. To do so, issue the following commands:
```
sudo cp /etc/keystone/ssl/certs/ca.pem /etc/ssl/certs/ca.pem
sudo c_rehash /etc/ssl/certs/ca.pem
```
We also take the same CA and CA Key file to use on our client, so copy these where you will be running the relevant python-*client tools. In our Vagrant environment, we can copy this to our host as follows:
```
sudo cp /etc/keystone/ssl/certs/ca.pem /vagrant/ca.pem
sudo cp /etc/keystone/ssl/certs/cakey.pem /vagrant/cakey.pem
```

We then need to edit the Keystone configuration file /etc/keystone/keystone.conf to include the following section:

[ssl]
enable = True
certfile = /etc/keystone/ssl/certs/keystone.pem
keyfile = /etc/keystone/ssl/private/keystonekey.pem
ca_certs = /etc/keystone/ssl/certs/ca.pem
cert_subject=/C=US/ST=Unset/L=Unset/O=Unset/CN=192.168.100.200
ca_key = /etc/keystone/ssl/certs/cakey.pem

Finally, restart the Keystone service:
```
sudo stop keystone
sudo start keystone
```

How it works...

The OpenStack services normally intercommunicate via standard HTTP requests. This provides a large degree of flexibility, but it comes at the cost of all communication happening in plain text. By adding SSL certificates and changing Keystone's configuration, all communication with Keystone will now be encrypted via HTTPS.

OpenStack Cloud Computing Cookbook, Third Edition

By : Cody Bunch

OpenStack Cloud Computing Cookbook, Third Edition

By: Cody Bunch

Overview of this book

Configuring OpenStack Identity for SSL communication

Getting ready

How to do it...

Tip

How it works...

OpenStack Cloud Computing Cookbook, Third Edition

By : Cody Bunch

OpenStack Cloud Computing Cookbook, Third Edition

By: Cody Bunch

Overview of this book

Configuring OpenStack Identity for SSL communication

Getting ready

How to do it...

Tip

How it works...

Delete Bookmark

Confirmation

Buy this book with your credits?