Custom Object Gateway SSl/TLS Certificate - Revision history

Qadmin: Qadmin moved page Custom S3 SSl/TLS Certificate to Custom Object Gateway SSl/TLS Certificate

2025-04-03T03:10:12Z

Qadmin moved page Custom S3 SSl/TLS Certificate to Custom Object Gateway SSl/TLS Certificate

← Older revision		Revision as of 03:10, 3 April 2025
(No difference)

Qadmin: /* Converting DER certificates to Base64 pem Format */

2024-06-07T21:29:49Z

Converting DER certificates to Base64 pem Format

← Older revision		Revision as of 21:29, 7 June 2024
Line 111:		Line 111:
	-----END PRIVATE KEY-----		-----END PRIVATE KEY-----
	</pre>		</pre>

			=== DER to PEM Format Conversion (optional) ===

	If your private key is in DER format, convert it to PEM using the following command:		If your private key is in DER format, convert it to PEM using the following command:

Qadmin: /* Converting DER certificates to Base64 pem Format */

2024-06-07T21:28:32Z

Converting DER certificates to Base64 pem Format

← Older revision		Revision as of 21:28, 7 June 2024
Line 86:		Line 86:
	=== Converting DER certificates to Base64 pem Format ===		=== Converting DER certificates to Base64 pem Format ===

	This shows how to take a DER formatted ~~file~~ (certnew.p7b) to produce a certificate chain (cert_chain.pem) PEM ~~file and a PRM file from~~ the ~~produced certificate (certnew.cer)~~:		This shows how to take a DER formatted files (certnew.p7b & certnew.cer) from your Certificate Authority to produce a certificate chain (cert_chain.pem) and certificate files in PEM format for use in the S3 Gateway:

	<pre>		<pre>
	openssl pkcs7 -print_certs -inform der -in certnew.p7b -out cert_chain.pem		openssl pkcs7 -print_certs -inform der -in certnew.p7b -out cert_chain.pem
			</pre>

			Next we'll .cer file from the produced certificate (certnew.cer) to convert it to PEM format:

			<pre>
	openssl x509 -inform der -in certnew.cer -out certnew.pem		openssl x509 -inform der -in certnew.cer -out certnew.pem
	</pre>		</pre>

Qadmin: /* Applying Cert to Existing S3 Gateways */

2024-06-07T21:23:52Z

Applying Cert to Existing S3 Gateways

← Older revision		Revision as of 21:23, 7 June 2024
Line 141:		Line 141:
	=== Applying Cert to Existing S3 Gateways ===		=== Applying Cert to Existing S3 Gateways ===

	Copy your certificate to '''/etc/ceph/ceph_<HOSTNAME>_radosgw.pem''' where <HOSTNAME> needs to be replace with the local host hostname which you can also get by running 'hostname' then restart the S3 gateway (radosgw) services with this command:		Copy your certificate to '''/etc/ceph/ceph_<HOSTNAME>_radosgw.pem''' where '''<HOSTNAME>''' needs to be replace with the local host hostname which you can also get by running 'hostname' then restart the S3 gateway (radosgw) services with this command:

	<pre>		<pre>

Qadmin: /* Test the Certificate */

2024-06-07T21:23:20Z

Test the Certificate

← Older revision		Revision as of 21:23, 7 June 2024
Line 164:		Line 164:
	<pre>		<pre>
	curl https://<FQDN of server>:<port>		curl https://<FQDN of server>:<port>
			</pre>

			Additionally if your client has openssl installed you can use it to print out the certificate from the S3 gateway, be sure to replace <FQDN of server> with your fqdn like s3.example.com and the <port> is typically 8580 which is the default load balancer port number on QuantaStor systems:

			<pre>
	echo -n \| openssl s_client -showcerts -connect <FQDN of server>:<port>		echo -n \| openssl s_client -showcerts -connect <FQDN of server>:<port>
	</pre>		</pre>

Qadmin at 21:21, 7 June 2024

2024-06-07T21:21:09Z

← Older revision		Revision as of 21:21, 7 June 2024
Line 1:		Line 1:
	When configuring QuantaStor scale-out clusters with an object storage zone it is important to setup a SSL/TLS ~~certification~~ to associate with the S3 gateway (CephRGW) so that clients connecting are able to validate the certificate against either an internal or public certificate authority (CA). This article goes of the procedure for making a SSL certificate ~~for that purpose~~ using OpenSSL ~~along with~~ a series of 'Alt Names' or 'Subject Alt Names' which identifies all the FQDNs for all the ports on all the QuantaStor systems that make up the cluster and any floating cluster wide FQDNs that my be used to access the S3 gateways.		When configuring QuantaStor scale-out clusters with an object storage zone it is important to setup a SSL/TLS certificate to associate with the S3 gateway (CephRGW) so that clients connecting are able to validate the certificate against either an internal or public certificate authority (CA). This article goes into the procedure for making a SSL certificate using OpenSSL. In the configuration of the openssl setting one will set a series of 'Alt Names' or 'Subject Alt Names' which identifies all the FQDNs for all the ports on all the QuantaStor systems that make up the cluster and any floating cluster wide FQDNs that my be used to access the S3 gateways as well as any IP addresses used to access the S3 gateways. If you are pre-planning a deployment we highly recommend gather this information and generating the certificates ahead of time.

	== S3 Certificate CSR generation and signing using Windows AD/Certificate Authority ==		== S3 Certificate CSR generation and signing using Windows AD/Certificate Authority ==

Qadmin: /* Concatenate the Private Key, Certificate, and Chain */

2024-06-07T21:17:06Z

Concatenate the Private Key, Certificate, and Chain

← Older revision		Revision as of 21:17, 7 June 2024
Line 120:		Line 120:

	<pre>		<pre>
	cat s3_adtest_osnexus_net.key certnew.pem cert_chain.pem > s3_adtest_osnexus_net.pem		cat s3_adtest_osnexus_net.key certnew.pem cert_chain.pem > s3_adtest_osnexus_net.pem
	</pre>		</pre>

Qadmin: /* Converting DER certificates to Base64 pem Format */

2024-06-07T21:16:58Z

Converting DER certificates to Base64 pem Format

← Older revision		Revision as of 21:16, 7 June 2024
Line 101:		Line 101:
	Next ensure your private key is now in PEM format, it should look like this in a text editor with BEGIN and END blocks showing the key in Base64 format:		Next ensure your private key is now in PEM format, it should look like this in a text editor with BEGIN and END blocks showing the key in Base64 format:

	<pre>		<pre>
	-----BEGIN PRIVATE KEY-----		-----BEGIN PRIVATE KEY-----
	(Your private key here)		(Your private key here)
	-----END PRIVATE KEY-----		-----END PRIVATE KEY-----
	</pre>		</pre>

	If your private key is in DER format, convert it to PEM using the following command:		If your private key is in DER format, convert it to PEM using the following command:

	<pre>		<pre>
	openssl rsa -inform DER -outform PEM -in derformat.key -out s3_adtest_osnexus_net.key		openssl rsa -inform DER -outform PEM -in derformat.key -out s3_adtest_osnexus_net.key
	</pre>		</pre>

			Replace `derformat.key` with the path to your DER-formatted private key and `s3_adtest_osnexus_net.key` with the desired output filename for the PEM-formatted private key.
	Replace `derformat.key` with the path to your DER-formatted private key and `s3_adtest_osnexus_net.key` with the desired output filename for the PEM-formatted private key.

	=== Concatenate the Private Key, Certificate, and Chain ===		=== Concatenate the Private Key, Certificate, and Chain ===

Qadmin: /* Verify the Contents */

2024-06-07T21:16:29Z

Verify the Contents

← Older revision		Revision as of 21:16, 7 June 2024
Line 131:		Line 131:

	<pre>		<pre>
	openssl x509 -in s3_adtest_osnexus_net.pem -text -noout		openssl x509 -in s3_adtest_osnexus_net.pem -text -noout
	</pre>		</pre>

Qadmin: /* Verify the Contents */

2024-06-07T21:16:23Z

Verify the Contents

← Older revision		Revision as of 21:16, 7 June 2024
Line 130:		Line 130:
	You can check the contents of the final PEM file to ensure all parts are included correctly:		You can check the contents of the final PEM file to ensure all parts are included correctly:

	<pre>		<pre>
	openssl x509 -in s3_adtest_osnexus_net.pem -text -noout		openssl x509 -in s3_adtest_osnexus_net.pem -text -noout
	</pre>		</pre>

	This command will display the certificate details. You won't be able to view the private key this way (and you shouldn't be able to), but you can open the PEM file in a text editor to ensure the private key and certificates are present.		This command will display the certificate details. You won't be able to view the private key this way (and you shouldn't be able to), but you can open the PEM file in a text editor to ensure the private key and certificates are present.