[ovirt-users] Re: Missing step(s) after custom x509 certificates

On Mon, Jun 18, 2018 at 4:19 PM, John Florian <john(a)doubledog.org&gt; wrote: I don't remember every exact detail in the docs, but I do know the relevant code. The engine (itself) runs as user ovirt, and can't touch or do anything to your httpd conf. engine-setup is basically the only thing [1] that runs as root and touches httpd conf. It asks you some stuff, and does (currently) only these things: 1. Always add /etc/httpd/conf.d/z-ovirt-engine-proxy.conf . This file is considered to be "owned" by engine-setup and can be changed as needed by upgrades. So you are not supposed to touch it. 2. Optionally add /etc/httpd/conf.d/ovirt-engine-root-redirect.conf which does a very simple redirect from '/' to '/ovirt-engine'. I am not aware of anyone not doing this, and guess things might not work perfectly, and also that it might be unsupported, but in principle you can reply 'no', and then have other web apps on the engine machine. See also [2]. This is _not_ done on upgrades - so if you reply 'yes', then remove the file, then run 'engine-setup' again, it should not re-add the file. 3. Optionally edit ssl.conf, which is the subject of current thread. This one also used to be not done on upgrades, but this recently changed [3][4]. This is considered mandatory and the only supported flow in production. If you reply 'no', you are supposed to configure apache manually. However, for development, you can talk to jboss directly [5]. This used to be possible also in production in very old releases, see e.g. [6]. So, to summarize: We (engine developers, engine-setup in particular) try to be "good citizens" and not take control of the machine, allowing the admin do what s/he wants, and still try hard to make the engine work nicely. But we default to do "take over", and (IIRC) only document the default, and (IIUC) only test the default - so anything else is somewhat more likely to cause problems. [1] currently. We add lots of ansible stuff in recent releases, I suspect that engine-setup has a chance to be partially replaced with ansible code some time. [2] https://bugzilla.redhat.com/show_bug.cgi?id=961677 [3] https://bugzilla.redhat.com/1558500 [4] https://bugzilla.redhat.com/1576377 [5] https://www.ovirt.org/develop/developer-guide/engine/engine-development-e... [6] https://bugzilla.redhat.com/show_bug.cgi?id=905754 Patches (or at least RFEs) are welcome :-) Also note that movirt, IIUC, should get from httpd the entire chain of certs, including the root one (your CA's cert), so in principle can simply prompt you, asking "Do you want to trust this CA cert?". Browsers, at least most of them, at least by default, never do this - they only prompt you asking if you want to trust a specific https cert, and require the user to manually import CA certs (I guess with the assumption that most users should only use the "well known" ones shipped with the browser, and that sysadmins that want an organization-wide CA will add its cert to their clients using other means). But they do let you use the CA cert right from inside the browser - e.g., I now tried this: 1. engine-setup 2. connect with firefox to the machine. Got "insecure", pressed "Advanced", "Add exception", "Get certificate", "View...", "Details" tab, selected the top cert in the hierarchy (which is the engine's CA cert - defaults to $FQDN.$RANDOM_NUMBER), "Export", "Save", closed everything. 3. Then went to the browser's menu, "Edit", "Preferences", "Advanced", "Certificates", "View certificates", "Authorities", "Import", opened the file I saved in (2.), checked "Trust this CA to identify websites", "OK", "OK" 4. Now connect again to the web admin url, it does not say anymore it's an unknown issuer. Nothing prevents firefox, or movirt, from doing all of the above with a single button click. The only reason they don't, and which is a quite good reason, is that it's risky for the user, and they want to make it hard to lower the risk. The flow above, needless to say, has nothing to with oVirt - it's all part of httpd's configuration and the SSL protocol. By all means, yes, and if you run into problems, please open bugs. With [3] _and_ [4] above fixed, engine-setup, on upgrades, should only change (currently) SSLProtocol, after asking you, and not override any other option you set there. -- Didi