Project

General

Profile

Actions

SSL » History » Revision 5

« Previous | Revision 5/11 (diff) | Next »
Corey Osman, 11/11/2011 06:42 PM


SSL setup

The smart proxy can work in SSL mode, where both sides verify and trust each other.

Configure SSL certificates

This request will only be accepted if the SSL certificates match. Therefore the client's private key grants access to proxy's funtionality, so protect it.

As this tool is meant to interoperate with a puppet installation I suggest that you use the Certificate Authority provided by a puppet server as your CA.

  1. Login to your puppetmaster, which has a Certificate Authority
  2. Use the puppet tools to create a new certificate
    
      puppetca --generate <proxy-FQDN>
    
  3. Copy the certificate keys to your Windows host
    
        scp puppetmaster:/var/lib/puppet/ssl/ca/signed/<proxy-FQDN>.pem signed.pem
        scp puppetmaster:/var/lib/puppet/ssl/private_keys/<proxy-FQDN>.pem private.pem
    
  4. Copy the ssl/certs/ca.pem from any puppet client to the smart-proxy\config directory. This ensures that the proxy trusts the same CA as a puppet client.

Troubleshooting

Unable to save
Unable to communicate with the proxy: No such file or directory - /.puppet/var/ssl/certs/foremanserver.domainname.corp.pem
Please check the proxy is configured and running on the host before saving.
Workaround
  1. mkdir /.puppet
  2. ln -s /var/lib/puppet/ /.puppet/var
  3. add foreman, foreman-proxy to puppet group
  4. chmod -R 640 /var/lib/puppet/ssl/private_keys
  5. chgrp -R puppet /var/lib/puppet/ssl/private_keys #

Updated by Corey Osman about 13 years ago · 11 revisions