Skip to content
This repository has been archived by the owner on Aug 30, 2024. It is now read-only.

iam 3.3 server certs spec

Jump to bottom
chris grzegorczyk edited this page Mar 27, 2013 · 1 revision

Table of Contents

Server Certificate Handling

Supporting SSL for ELB instances [1] [2] [3] [4] implies having:

  1. The ability to provide the system w/ (1) the certificate, (2) the private key, (3) the trust chain [9]
  2. Policy for storing the private key securely.
  3. Enabling secure access/transfer of the private key to the

Private Keys and Certificates

  • Key length: 1024, 2048-bit and 4096-bit encryption.
  • Keys, Certificates, and Trust Chain must in PEM format.
  • Certificates must follow the X.509 PEM format.
  • The current date must be between the certificate’s start and end date.
  • Public and private certificate files must contain only a single certificate.
  • The private key must match the public key that is in the digital server certificate.
  • The private key must be an RSA private key in PEM format, where the PEM header is BEGIN RSA PRIVATE KEY and the footer is END RSA PRIVATE KEY (as shown in Sample Certificates).
  • The private key cannot be encrypted with a password.
  • A certificate chain starts with the immediate signing certificate and is then followed by any intermediaries in order. Intermediaries that are not involved in the trust path must not be included. The trusted root certificate can be optionally included as the last certificate.
  • Names of server certificates must be alphanumeric, including the following common characters: plus (+), equal (=), comma (,), period (.), at (@), and dash (-).
=== Key, Cert, and Trust Chain TODO: Desciption of key, cert, and trust chain; their requirements.

Private Key Security

Private key is a secret token and should be treated as such.

  • Access to a private key should be restricted to those who "need to know"
  • A private key should not be sent over the wire or, if it cannot be avoided, only be sent in an encrypted form
  • A private key should only be communicated to a trusted/authenticated party

Private Key Storage

  • when stored in the eucalyptus database, a private key should be encrypted with the owning component's key (i.e., EUARE's key)

Load Balancer VM Access to Private Keys

TODO: Requirements for transferring private keys to LB VMs

Possible scenarios:

  • sending the key over the metadata service
    • cons: how to do it securely?
  • injecting the key using the CLC -> CC -> NC communication path
    • cons: the server key might need to be updated at runtime
    • pros: explores existing trust relation in the system
  • communicating the key using internal LB-to-ELB API
    • cons: temprorary credentials are distributed to LBs via an insecure channel (metadata service), so they should not be used to give access to a data with a higher sensitivity level like server certs, which are external to Eucalyptus and generally have a longer lifetime than a load balancer

Operations & Order-of-Operations

iam-servercertgetattributes

TODO: Review & Summarize reference [5]

UploadServerCertificate

TODO: Review & Summarize reference [6]

CreateLoadBalancer

TODO: Review & Summarize reference [7] [2]

SetLoadBalancerListenerSSLCertificate

TODO: Review & Summarize reference [4]

DescribeLoadBalancerPolicies

TODO: Review & Summarize reference [8]

CreateLoadBalancerPolicy

TODO: Review & Summarize reference [8]

SetLoadBalancerPoliciesOfListener

TODO: Review & Summarize reference [8]

ConfigureHealthCheck

TODO: Review & Summarize reference [8]

References

  1. ^ http://docs.aws.amazon.com/ElasticLoadBalancing/latest/APIReference/API_SetLoadBalancerListenerSSLCertificate.html
  2. a b http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/creating_lb_QueryAPI.html
  3. ^ http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/US_SettingUpLoadBalancerHTTPS.html
  4. a b http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/US_UpdatingLoadBalancerSSL.html
  5. ^ http://docs.aws.amazon.com/IAM/latest/CLIReference/servercertgetattributes.html
  6. ^ http://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadServerCertificate.html
  7. ^
  8. a b c d http://docs.aws.amazon.com/ElasticLoadBalancing/latest/APIReference/API_DescribeLoadBalancerPolicies.html
tag:rls-3.3
Clone this wiki locally