Kamis, 09 Oktober 2025

Enable SSL/TLS on the Red Hat OpenStack Platform (RHOSP)

Written by   in ,  

 Halo guys, Ridwan here
Come again with a new notes update!

Last notes, kita bahas bagaimana deploy Red Hat Openstack Platform (RHOSP),
Pada standart instalasi/minimal deployment, horizon & service-service dari Openstack memang belum mengaktifkan SSL.

Banyak orang berpikir kalau lingkungan Non-Public / Internal tidak perlu enable SSL/TLS, padahal sebenarnya tetap penting. Berikut alasan-alasan kenapa SSL tetap perlu diaktifkan :

  1. Standar Keamanan & Kepatuhan
    Banyak standar keamanan (ISO 27001, PCI-DSS, HIPAA) mewajibkan enkripsi end-to-end, termasuk untuk sistem internal.
  2. Mencegah Serangan dari Dalam (Insider Threats)
    Walau jaringanmu “tertutup”, komunikasi antar layanan (API, dashboard, message queue, dll.) tetap lewat jaringan, dan bisa disadap oleh siapa pun yang punya akses internal.
  3. Integrasi dengan Komponen Eksternal
    Beberapa komponen atau tools pihak ketiga mungkin tetap membutuhkan koneksi HTTPS untuk berfungsi dengan baik, meskipun sistem utama bersifat offline.

oleh karena itu catatan kali ini, kita akan mencoba men'enable SSL pada RHOSP

Penasaran..Bagaimana Caranya Setup & Config nya?
Langsung saja kita coba !


Creating a Signing Host for Certificate Authority 

Biasanya, kita menandatangani sertifikat SSL/TLS dengan otoritas sertifikat eksternal. 
Dalam beberapa situasi, kita mungkin ingin menggunakan otoritas sertifikat sendiri. Misalnya, kita mungkin ingin memiliki otoritas sertifikat internal saja.

1. Initializing the signing host

Signing Host adalah host yang membuat dan menandatangani sertifikat baru dengan otoritas sertifikat, kita perlu menginisialisasi host tersebut agar dapat menandatangani sertifikat baru.

File /etc/pki/CA/index.txt berisi rekaman semua sertifikat yang ditandatangani

$ sudo mkdir -p /etc/pki/CA && sudo touch /etc/pki/CA/index.txt

identifikasi nomor seri berikutnya yang akan digunakan untuk sertifikat berikutnya yang akan ditandatangani. Periksa apakah berkas ini ada. Jika berkas tidak ada, buat berkas baru dengan nilai awal yang baru:

$ echo '1000' | sudo tee /etc/pki/CA/serial

2. Generate (ca.key.pem & ca.crt.pem)  :

This SSL/TLS key and certificate pair will act as the certificate authority :

$ openssl genrsa -out ca.key.pem 4096
$ openssl req  -key ca.key.pem -new -x509 -days 7300 -extensions v3_ca -out ca.crt.pem

Reff: https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/hardening_red_hat_openstack_platform/assembly_configuring-custom-ssl-tls-certificates#proc_creating-a-certificate-authority_configuring-custom-ssl-tls-certificates

3.  Adding the certificate authority to clients

Untuk klien eksternal atau mana pun yang ingin berkomunikasi menggunakan SSL/TLS, salin berkas otoritas sertifikat ke setiap klien yang memerlukan akses ke lingkungan Red Hat OpenStack Platform Anda.

$ sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/
$ sudo update-ca-trust extract

Reff:  https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/hardening_red_hat_openstack_platform/assembly_configuring-custom-ssl-tls-certificates#proc_adding-the-certificate-authority-to-clients_configuring-custom-ssl-tls-certificates


Creating an SSL/TLS for a Server/Service 


1. Create the SSL/TLS Certificate key (server.key.pem)

Jalankan perintah berikut untuk membuat / generate SSL/TLS key :

$ openssl genrsa -out server.key.pem 2048

2. Create SSL/TLS Certificate Signing Request (server.csr.pem)

Untuk membuat Certificate Signing Request (CSR) file kita akan menggunakan openssl, let's copy default template openssl.cnf ke working directory kita saat ini.

$ cp /etc/pki/tls/openssl.cnf .

Edit file "openssl.cnf" tersebut, dan sesuaikan beberapa parameter di Bawah :

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req

[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = AU
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Queensland
localityName = Locality Name (eg, city)
localityName_default = Brisbane
organizationalUnitName = Organizational Unit Name (eg, section)
organizationalUnitName_default = Red Hat
commonName = Common Name
commonName_default = 192.168.0.1
commonName_max = 64

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.0.1
DNS.1 = instack.localdomain
DNS.2 = vip.localdomain
DNS.3 = 192.168.0.1

Jika sudah sesuai semua parameter pada file tersebut, generate file csr dengan command berikut :

$ openssl req -config openssl.cnf -key server.key.pem -new -out server.csr.pem


3. Create SSL/TLS Certificate (server.crt.pem)

Sebelum membuat SSL/TLS Certificate, pastikan file-file berikut sudah ready

  • openssl.cnf
    The customized configuration file that specifies the v3 extensions.
  • server.csr.pem
    The certificate signing request to generate and sign the certificate with a certificate authority.
  • ca.crt.pem
    The certificate authority, which signs the certificate.
  • ca.key.pem
    The certificate authority private key.

Jalankan command berikut untuk membuat file Certificate

$ sudo mkdir -p /etc/pki/CA/newcerts
$ sudo openssl ca -config openssl.cnf -extensions v3_req -days 3650 -in server.csr.pem -out server.crt.pem -cert ca.crt.pem -keyfile ca.key.pem

Jika berhasil output nya akan, tampil seperti berikut :

Reff :
https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/hardening_red_hat_openstack_platform/assembly_configuring-custom-ssl-tls-certificates#proc_creating-an-ssl-tls-key_configuring-custom-ssl-tls-certificates


Config / Add the Certificate file to the undercloud deployment

Sebelum lanjut ke step ini, pastikan semua step sebelumnya berhasil dengan benar !

1. Create undercloud.pem

Jalankan perintah berikut untuk menggabungkan file sertifikat dan file key :

$ cat server.crt.pem server.key.pem > undercloud.pem

2. Copy undercloud.pem & Config Selinux Context

Copy file undercloud.pem ke directory "/etc/pki/"

$ sudo mkdir /etc/pki/undercloud-certs
$ sudo cp ~/undercloud.pem /etc/pki/undercloud-certs/.

Dan config SELinux context :

$ sudo semanage fcontext -a -t etc_t "/etc/pki/undercloud-certs(/.*)?"
$ sudo restorecon -R /etc/pki/undercloud-certs

3. add parameter into "undercloud.conf"

edit file "undercloud.conf" kalian :

$ vi undercloud.conf

Dan cari paramter berikut :

undercloud_service_certificate = /etc/pki/undercloud-certs/undercloud.pem

4. Add trusted Certificate Authorities list

Add the certificate authority that signed the certificate to the list of trusted Certificate Authorities

$ sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/
$ sudo update-ca-trust extract

To verify the certificate authority was added to the undercloud, use openssl to check the trust bundle:

$ openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs -text | grep <CN of the CA issuer> -A 10 -B 10

Jika berhasil output nya akan seperti tampilan berikut :

Reff:
https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/hardening_red_hat_openstack_platform/assembly_configuring-custom-ssl-tls-certificates#proc_adding-the-certificate-to-the-undercloud_configuring-custom-ssl-tls-certificates


Enabling SSL/TLS on overcloud

1. Edit file "enable-tls.yaml"

Copy templates file "enable-tls.yaml" ke dalam directory deployment kita :

$ cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml ~/templates/.

edit file tersebut :

$ vi ~/templates/enable-tls.yaml

ada tiga parameter yang harus kalian isikan :

  • SSLCertificate (server.crt.pem)

SSLCertificate: |

 -----BEGIN CERTIFICATE-----

  • SSLIntermediateCertificate (optional)

SSLIntermediateCertificate: |

 -----BEGIN CERTIFICATE-----

  • SSLKey (server.key.pem)

  SSLKey: |

  -----BEGIN RSA PRIVATE KEY-----

2. Edit file "inject-trust-anchor-hiera.yaml"

Copy templates file "inject-trust-anchor-hiera.yaml" ke dalam directory deployment kita :

$ cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor-hiera.yaml ~/templates/.

edif file tersebut, :

$ vi ~/templates/inject-trust-anchor-hiera.yaml

isikan parameter CAMap dengan konten dari ca.crt

parameter_defaults:
# Map containing the CA certs and information needed for deploying them.
CAMap:
kinton-CA-cert:
content: |
-----BEGIN CERTIFICATE-----
MIIGFzCCA/+gAwIBAgIUXcsfQFyt/GtQzVtKscY0qo0KATQwDQYJKoZIhvcNAQEL
-----END CERTIFICATE-----

3. Edif file "custom-domain.yaml"

If you use a DNS hostname to access the overcloud through SSL/TLS,  Copy templates file "custom-domain.yaml" ke dalam directory deployment kita :

$ cp -r /usr/share/openstack-tripleo-heat-templates/environments/predictable-placement/custom-domain.yaml ~/templates/.

edit file tersebut, dan config beberapa parameter berikut :

  • CloudDomain
    the DNS domain for hosts.
  • CloudName
    The DNS hostname of the overcloud endpoints.
  • CloudNameCtlplane
    The DNS name of the provisioning network endpoint.
  • CloudNameInternal
    The DNS name of the Internal API endpoint.
  • CloudNameStorage
    The DNS name of the storage endpoint.
  • CloudNameStorageManagement
    The DNS name of the storage management endpoint.

4. Run overcloud deploy !

sebelum menlanjutkan, pastikan file-file berikut sudah ready

  • The environment file to enable SSL/TLS (enable-tls.yaml)
  • The environment file to set the DNS hostname (custom-domain.yaml)
  • The environment file to inject the root certificate authority (inject-trust-anchor-hiera.yaml)

dan tambahkan file berikut ke dalam command overcloud deploy kalian, 

$ openstack overcloud deploy --templates \
[...]
-e /home/stack/templates/enable-tls.yaml \
-e ~/templates/custom-domain.yaml \
-e ~/templates/inject-trust-anchor-hiera.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml

Tunggu hingga proses overcloud deploy selesai !

Reff:
https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/hardening_red_hat_openstack_platform/assembly_enabling-ssl-tls-on-overcloud-public-endpoints#proc_enabling-ssl-tls_enabling-ssl-tls-on-overcloud-public-endpoints


Ok.
Thank you sudah membaca tulisan ini, Semoga bermanfaat !

Best Regards
Rdw

Share: