Self-Cert SSL certificate

[douglowe]

Create an SSL certificate for signing Harbor, and other traffic.

[douglowe]

On the front facing VM this will be done in: /opt/SSL_cert/ as user 5stes

[douglowe]

First create the root CA:

1. mkdir ca, cd ca
2. Create the rootCA.key file (and protect it)
   • openssl genrsa -out rootCA.key 4096
   • chmod 600 rootCA.key
3. Create the rootCA.crt file
   • openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.crt
   • Fill out registration information

[douglowe]

Create the Harbor Server Certificates. In a directory parallel to the one above:

1. Create the harbor-dmz.key file
   • openssl genrsa -out harbor-dmz.key 4096
2. Create the certificate signing request (CSR)
   • openssl req -new -key harbor-dmz.key -out harbor-dmz.csr
   • Note: CN must match DNS (set this to the IP address if needed)

Repeat for the harbor-internal.key file:

1. Create the harbor-internal.key file
   • openssl genrsa -out harbor-internal.key 4096
2. Create the certificate signing request (CSR)
   • openssl req -new -key harbor-internal.key -out harbor-internal.csr
   • Note: CN must match DNS (set this to the IP address if needed)

[douglowe]

Create SAN extension files for the DMZ and the internal services.

DMZ (harbor-dmz.ext)

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = 10.99.53.84.sslip.io
IP.1 = 10.99.53.84

Internal (harbor-internal.ext)

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = masc-compute03.soe.manchester.ac.uk
IP.1 = 10.109.248.144

[douglowe]

DMZ signing:

openssl x509 -req \
  -in harbor-dmz.csr \
  -CA rootCA.crt \
  -CAkey rootCA.key \
  -CAcreateserial \
  -out harbor-dmz.crt \
  -days 825 \
  -sha256 \
  -extfile harbor-dmz.ext

Internal signing:

openssl x509 -req \
  -in harbor-internal.csr \
  -CA rootCA.crt \
  -CAkey rootCA.key \
  -CAcreateserial \
  -out harbor-internal.crt \
  -days 825 \
  -sha256 \
  -extfile harbor-internal.ext

[douglowe]

Install root certificate on all hosts (required for setting up docker to trust harbor)

1. Copy the root certificate (rootCA.crt) to other VMs running docker.
2. Install the CA system-wide:
   • sudo cp rootCA.crt /usr/local/share/ca-certificates/company-root-ca.crt
   • sudo update-ca-certificates

[douglowe]

Convert the *.crt files into *.cert files for docker:

1. openssl x509 -inform PEM -in harbor-dmz.crt -out harbor-dmz.cert
2. openssl x509 -inform PEM -in harbor-internal.crt -out harbor-internal.cert

[douglowe]

This is done - however the notes here are messy (and need tidying / clarification), and I think we need to document here the changes in the docker usage of SSL certificates.