ManageIQ SSL configuration of an external database

[szajac01]

ManageIQ Hardening guide (https://www.manageiq.org/docs/reference/latest/appliance_hardening_guide/) talks about SSL configuration of a Database Appliance, is it possible to add a chapter regarding external Databases SSL configuration ?
Is it the same steps ?
Also i would like to know what is referencing the root.crt certificate to import in connected appliance in Chapter Configure SSL on all connected appliances...

[Fryguy]

@bdunne Can you answer this one?

---

@szajac01 Separately, please don't open a discussion and an issue because it just creates duplicate issues/issue management for us. If you have an actual bug or feature request, open an issue; if you have a discussion topic, then open an discussion and if in the course of the discussion a bug is found, then we can open an issue. (I know you were trying to bump to get our attention since this was opened Sep 30 with no reponse, so I understand, but please just post another comment in the discussion and we should see it)

[szajac01]

Hi, @Fryguy no problem, that was effectively the goal, sorry i will try to not reproduce.

[bdunne]

@szajac01 At a high level, it should be the same whether you are using a ManageIQ appliance as an external database or building your own. You will need a server certificate (and key) that is signed by a CA.

1. You need to update the postgres server configuration to use that certificate and key and tell it to accept hostssl connections and disable non-ssl connections if you also want that.
2. On all appliances that connect to that database, they need to trust the CA that signed the certificate. If it's a public trusted CA, no further action should be required since those should already be in the bundle shipped with the OS. If it's a self-signed certificate, you'll need to tell the appliance to trust your CA by dropping the CA certificate in the /etc/pki/ directory and running update-ca-trust command as described in the document.
   In the example in the doc, I believe /var/www/miq/vmdb/certs/root.crt is the CA that was used to sign the certificate for the postgres server.