Replace HyperFlex Self-Signed SSL Certificates with CA-issued Certificates

Transcription

1 Replace HyperFlex Self-Signed SSL Certificates with CA-issued Certificates Contents Google Chrome Mozila FireFox Software Credentials HX Cluster DNS Server Certificate Authority vcenter Server 1. Create a Host Record (A Record) for All SCVMs and the Cluster Management IP (CMIP) NOTE: Repeat steps for all SCVMs and the CMIP 2. Refresh the DNS Manager to Confirm All Entries Are Present 3. Perform a Ping Test to Confirm the FQDN Is Resolvable 4. Logout of the DNS Server 1. Generate a Private Key and a Certificate Signing Request (CSR) 2. Review the Newly Generated CSR and Copy It to Notepad NOTE: Keep track of which CSR belongs to which SCVM as they will be used in Section III 3. Generate DH Parameters 4. Create Snippets and Sites-Available Directories 5. Create Default File and a Backup Default File Repeat steps on remaining SCVMs 1. Submit a Certificate Request san:dns= NOTE: Repeat steps for remaining SCVMs 2. Open Each Certificate NOTE: If the SAN is not listed, check that the CA issuing the certificate has the ability to include the SAN entry Example 3. Download the Certificate for the CA or the Certificate Chain NOTE: Choose this option if this is the only CA in the domain 4. Convert the PKCS#7 Certificate to an X.509 Base64 Encoded Certificate 1. Import the New Certificates for the SCVMs 2. Copy the Certificates to /etc/ssl/certs Directory 3. Test the Configuration 4. Restart the Nginx Service 5. Generate a New Thumbprint 6. Restart stmgr Service 7. Re-register the Cluster 8. Login to vcenter and Confirm the HXDP Plugin Is Accessible

2 1. Google Chrome Certificate Installation 2. Mozilla FireFox Certificate Installation 1. Google Chrome Verification 2. Mozilla FireFox Verification INTRODUCTION When HyperFlex is deployed, it employs self-signed SSL certificates for the storage controller VMs (SCVMs). This will cause users to receive a connection is not secure message when access HX Connect. This document will provide the steps for replacing the self-signed certificate with a signed certificate, thus making the connection fully secured and the error message will no longer be triggered by modern web brownsers. Contributed by Cliff Aldan and Ignacio Orozco, Cisco TAC Engineers When accessing the HyperFlex Connect site, it shows that the site is not secure on browsers like Google Chrome and Mozilla FireFox. Organizations would like to use certificates issued by their own trusted root Certificate Authority (CA) to secure the connection for the HyperFlex Connect dashboard. How can organizations replace these certificates with ones issued by their CA? Google Chrome Mozila FireFox

3 SOLUTION Generate a new private key and Certificate Signing Request (CSR) from all SCVMs Submit each CSR to a CA that will issue the certificates Import the newly generated certificates to their respective SCVM and replace the existing certificate Generate a new thumbprint and update the application configuration file Restart services - nginx, stmgr Reregister the HX cluster to vcenter PREREQUISITES Software SSH client software MobaXtermis recommended to assist with multiexec on all SCVMs MobaXterm software download URL: Credentials You will need the following login credentials These accounts are needed in order to perform the steps in this article HX Cluster For HXDP plugin access via vsphere Web Client vcenter local SSO administrator account (typically, administrator@vsphere.local) OR Active Directory domain user account with the same administrative privileges as the local SSO adminitrator For HX Connect access (HX 2.5 and later) local/root user account

4 OR vcenter local SSO administrator account (typically, OR Active Directory domain user account with the same administrative privileges as the local SSO adminitrator For SCVM console or SSH access root user account DNS Server For DNS on Windows console or Remote Desktop access Active Directory domain account with DNS server administrative privileges Certificate Authority For CA on Windows console or Remote Desktop access Local user account with administrative privileges (for standalone root CA) OR Active Directory domain account with CA server administrative privileges (for AD-integrated root CA) vcenter Server For vsphere Web Client access vcenter local SSO administrator account (typically, OR Active Directory domain user account with the same administrative privileges as the local SSO administrator SECTION I: DNS Configuration 1. Create a Host Record (A Record) for All SCVMs and the Cluster Management IP (CMIP) Login to the DNS server with a user account with administrative privileges for DNS Launch the DNS Manager console from Server Manager > Tools > DNS

5 Expand DNS > Forward Lookup Zones > domain Right click the domain and select New Host (A or AAAA)... Fill out the New Host information to create the Fully Qualified Domain Name (FQDN) The pointer (PTR) record checkbox is selected by default and will add the information for the Reverse Lookup for the respective zone Click Add Host to complete this task

6 NOTE: Repeat steps for all SCVMs and the CMIP 2. Refresh the DNS Manager to Confirm All Entries Are Present 3. Perform a Ping Test to Confirm the FQDN Is Resolvable

7

8 4. Logout of the DNS Server SECTION II: HyperFlex Configuration SSH to all SCVMs 1. Generate a Private Key and a Certificate Signing Request (CSR) Type openssl req -nodes -newkey rsa:2048 -keyout /etc/ssl/private/<scvm>.key -out /etc/ssl/certs/<scvm>.csr to generate a private key and CSR root@springpathcontrollervwxyz56789:~# openssl req -nodes -newkey rsa:2048 -keyout /etc/ssl/private/hx-4-scvm-01.key -out /etc/ssl/certs/hx-4-scvm-01.csr Generating a 2048 bit RSA private key writing new private key to '/etc/ssl/private/hx-4-scvm- 01.key' You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:CA Locality Name (eg, city) []:San Jose Organization Name (eg, company) [Internet Widgits Pty Ltd]:Global TAC Organizational Unit Name (eg, section) []:Storage Team Common Name (e.g. server FQDN or YOUR name) []:hx-4-scvm- 01.sjs.local Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:Cisco Systems, Inc. 2. Review the Newly Generated CSR and Copy It to Notepad Type cat /etc/ssl/certs/<scvm>.csr to display the output of the CSR root@springpathcontrollervwxyz56789:~# cat /etc/ssl/certs/hx-4-scvm-01.csr -----BEGIN CERTIFICATE REQUEST----- MIIDADCCAegCAQAwgZwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTERMA8GA1UE BwwIU2FuIEpvc2UxDDAKBgNVBAoMA1NKUzEVMBMGA1UECwwMU3RvcmFnZSBUZWFt MSMwIQYDVQQDDBpzanMtaHgtNy1zY3ZtLTAxLnNqcy5sb2NhbDEjMCEGCSqGSIb3 DQEJARYUc2otc3RvcmFnZUBjaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQDMYJGsJmIv6z1qGThYxVKXf+Wj14e5HCx9R8MawOVBYnVReaII ltzex6cg3zmg47zitegpdzhtpmjv3sxmbo0ovushheczld7cpybyk+mkq6eqf1px KAGr6EKYwTHI8d4j5A7domVdt72qOajZlj6YuSz2FJk5ZQP57Don9v9zzZLynfkt H+B8BM4r+HhMFUyBkRSHCLnj5/1bzUlky9FL68AIK7ye92MgWZNJlN4x4w1xXQld mvcw8/6b/alkjqp3i4vl33qr/nxwlsqi8nozve/zkg5o5wolsx2+qsbsix1edhg4 FhijJ7CQ1WcarnrgVuP+WJ6lsqiBPnglTOYhAgMBAAGgHjAcBgkqhkiG9w0BCQIx DwwNQ2lzY28gU3lzdGVtczANBgkqhkiG9w0BAQsFAAOCAQEAFAB86JSoBN9ChOPq 2XkORzj73HLmAZ1VYTOTXierTvmGkIkYSdMMAvcWoW1MkoLME3W8tUEmYFBh5m5K GVcOzVBryBsSOJhd6f1nyu5D4c1C85HIhyLdBzcgZlMFqG9azzB+jKaX2wyCuboA DusAerKT1Rwba6X1mL7sr0XaLZ0kuwoOqk3Z9gelmFlF0nvKlsRbmafctiX/JkrS mnawtpuwxnk9tk4z2wzv/zpdsap4nvizjirxphr01+njhso7cfmhttady5dzkl3x 9BcsavVy2ctdh2nJGX/Qbfy9bo1ZNn/i6NpTL7gNT9mkxDg/53fREvlTQq090bPp Ko6eCg== -----END CERTIFICATE REQUEST----- Copy the output to Notepad (or Wordpad, Notepad++, etc)

9 NOTE: Keep track of which CSR belongs to which SCVM as they will be used in Section III 3. Generate DH Parameters Type openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time *++* root@springpathcontrollervwxyz56789:~# 4. Create Snippets and Sites-Available Directories Type mkdir -p /etc/nginx/snippets to create the snippets directory root@springpathcontrollervwxyz56789:~# mkdir -p /etc/nginx/snippets Type mkdir -p /etc/nginx/sites-available to create the sites-available directory root@springpathcontrollervwxyz56789:~# mkdir -p /etc/nginx/sites-available 5. Create Default File and a Backup Default File Type touch /etc/nginx/sites-available/default to create a default file root@springpathcontrollervwxyz56789:~# touch /etc/nginx/sites-available/default Type cp /etc/nginx/sites-available/default /etc/nginx/sites-available/default.bak to create a backup of the default file root@springpathcontrollervwxyz56789:~# cp /etc/nginx/sites-available/default /etc/nginx/sitesavailable/default.bak Type iptables -F to flush iptables root@springpathcontrollervwxyz56789:~# iptables -F Repeat steps on remaining SCVMs SECTION III: Certificate Request

10 1. Submit a Certificate Request Access the Web enrollment page for the Windows CA At the Welcome page, click the Request a certificate link At the Request a Certificate page, click the advanced certificate request link At the Submit a Certificate Request or Renew Request page perform the following: Saved Request: paste the CSR here from -----BEGIN CERTIFICATE REQUEST----- to END CERTIFICATE REQUEST----- Certificate Template: choose Web Server Additional Attributes: type the Subject Alternate Name that will include both the FQDN of the SCVM and the CMIP in that order san:dns=<scvm01 FQDN>&dns=<CMIP FQDN>

11 At the Certificate Issued page, select the following: Base 64 encoded radio button Download certificate link Save the certificate to a local directory

12 NOTE: Repeat steps for remaining SCVMs Confirm that all certificates have been generated and saved to a local directory 2. Open Each Certificate Go to Details and scroll to the bottom and select Subject Alternative Name (SAN) Confirm that both the SCVM and CMIP FQDN are listed

13 NOTE: If the SAN is not listed, check that the CA issuing the certificate has the ability to include the SAN entry Example Windows CA that uses Web Enrollment does not issue certificates with SANs by default

14 One option is to enable the inclusion of the SAN entry in the certificate for Web Enrollment Login to the CA server Launch the Command Prompt and run as administrator Type certutil -setreg policy\editflags +EDITF_ATTRIBUTESUBJECTALTNAME2 to enable Web Enrollment to include the SAN entry C:\Windows\system32>certutil -setreg policy\editflags +EDITF_ATTRIBUTESUBJECTALTNAME2 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\sjsca\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy\EditFlags: Old Value: EditFlags REG_DWORD = 11014e ( ) EDITF_REQUESTEXTENSIONLIST -- 2 EDITF_DISABLEEXTENSIONLIST -- 4 EDITF_ADDOLDKEYUSAGE -- 8 EDITF_BASICCONSTRAINTSCRITICAL (64) EDITF_ENABLEAKIKEYID (256) EDITF_ENABLEDEFAULTSMIME (65536) EDITF_ENABLECHASECLIENTDC ( ) New Value: EditFlags REG_DWORD = 15014e ( ) EDITF_REQUESTEXTENSIONLIST -- 2 EDITF_DISABLEEXTENSIONLIST -- 4 EDITF_ADDOLDKEYUSAGE -- 8 EDITF_BASICCONSTRAINTSCRITICAL (64) EDITF_ENABLEAKIKEYID (256) EDITF_ENABLEDEFAULTSMIME (65536) EDITF_ATTRIBUTESUBJECTALTNAME (262144) EDITF_ENABLECHASECLIENTDC ( ) CertUtil: -setreg command completed successfully. The CertSvc service may need to be restarted for changes to take effect. Type net stop certsvc and net start certsvc to restart the AD Certificate Services C:\Windows\system32>net stop certsvc The Active Directory Certificate Services service is stopping. The Active Directory Certificate Services service was stopped successfully. C:\Windows\system32>net start certsvc The Active Directory Certificate Services service is starting. The Active Directory Certificate Services service was started successfully. 3. Download the Certificate for the CA or the Certificate Chain Access the Web enrollment page for the Windows CA At thewelcomepage, click the Downalod a CA certificate, certificate chain, or CRLlink

15 At the Download a CA Certificate, Certificate Chain, or CRL, click the install this CA certificate link NOTE: Choose this option if this is the only CA in the domain Save the certificate to a local directory

16 If there are multiple CAs in the Active Directory domain, select Encoding method: Base64 and click the Download CA certificate chain link

17 Save the certificate chain to a local directory

18 4. Convert the PKCS#7 Certificate to an X.509 Base64 Encoded Certificate Open the directory where the certificate chain was saved to Right click the certificate chain and select Open When the certmgr window appears, traverse to Certificates on the left pane, right click the certificate chain on the right pane, and click Open

19 When the Certificate window appears, go to Details tab and select Copy to File...

20 When the Certificate Export Wizard window appears, click Next

21 At the Export File Format page, select Base-65 encoded X.509 (.CER) and click Next

22 At the File to Export page, click Browse...

23 When the Save As window appears, select a local directory, name the certificate chain file, and click Save Back at the File to Export page, confirm the file path and name and click Next

24 At the Completing the Certificate Export Wizard page, click Finish

25 Click OK to close out of the Certificate Export Wizard

26 SECTION IV: Replacing Certificates 1. Import the New Certificates for the SCVMs Copy each of the newly generated certificates to their respective SCVM using your preferred method (WinSCP, FileZilla, MobaXterm) 2. Copy the Certificates to /etc/ssl/certs Directory SSH to all SCVMs Type cd /etc/nginx/ to change directory to nginx cd /etc/nginx/ Type ls to list the files present in the nginx directory and confirm server.key and server.crt are present ls conf.d sites-available win-utf server.crt uwsgi_params fastcgi_temp snippets koi-utf nginx.conf scgi_params proxy_temp uwsgi_temp koi-win fastcgi.conf scgi_temp mime.types server.key fastcgi_params Type cp server.key server.key.bak to back up the server.key file cp server.key server.key.bak Type cp server.crt server.crt.bak to back up the server.crt file cp server.crt server.crt.bak Type ls to confim the files are present ls conf.d snippets koi-win nginx.conf fastcgi_temp uwsgi_temp server.key fastcgi.conf proxy_temp mime.types server.key.bak fastcgi_params scgi_temp win-utf server.crt uwsgi_params sites-available koi-utf server.crt.bak scgi_params Type cp /etc/ssl/certs/<scvm>.key /etc/nginx/server.key to replace the private key cp /etc/ssl/private/sjs-hx-4-scvm-01.key /etc/nginx/server.key Type cp /etc/ssl/certs/<scvm>.crt /etc/nginx/server.crt to replace the certificate cp /etc/ssl/certs/sjs-hx-4-scvm-01.cer /etc/nginx/server.crt

27 3. Test the Configuration Type nginx -t to test the configuration nginx -t Operating in CiscoSSL FIPS mode nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful 4. Restart the Nginx Service Type service nginx restart to restart the nginx service service nginx restart * Restarting nginx nginx [ OK ] 5. Generate a New Thumbprint Type openssl x509 -in /etc/nginx/server.crt -fingerprint -noout to generate the new thumbprint root@springpathcontrollervwxyz56789:/etc/nginx# openssl x509 -in /etc/nginx/server.crt - fingerprint -noout SHA1 Fingerprint=8E:89:01:5C:D2:8C:07:E3:0F:91:CB:DE:EF:FA:04:A2:AB:8F:8D:84 Type vi /opt/springpath/storfs-mgmt/stmgr-1.0/conf/application.conf to edit the application.conf root@springpathcontrollervwxyz56789:/etc/nginx# vi /opt/springpath/storfs-mgmt/stmgr- 1.0/conf/application.conf Go to the end of the application.conf file, insert the following lines, and save changes to the file (Hit Esc key and type wq!) springpath.keystore-rsa { } thumbprint="<thumbprint value>" springpath.keystore-rsa { thumbprint="8e:89:01:5c:d2:8c:07:e3:0f:91:cb:de:ef:fa:04:a2:ab:8f:8d:84" } 6. Restart stmgr Service Type restart stmgr to restart the stmgr service root@springpathcontrollervwxyz56789:/etc/nginx# restart stmgr stmgr start/running, process Type status stmgr to confirm the stmgr service is running root@springpathcontrollervwxyz56789:/etc/nginx# status stmgr stmgr start/running, process 22018

28 7. Re-register the Cluster Type ifconfig to determine which of the SCVMs has the CMIP ifconfig eth0 Link encap:ethernet HWaddr 00:0c:29:0a:c3:93 inet addr: Bcast: Mask: inet6 addr: fe80::20c:29ff:fe0a:c393/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets: errors:0 dropped:32 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes: (8.8 GB) TX bytes: (2.0 GB) eth1 Link encap:ethernet HWaddr 00:0c:29:0a:c3:9d inet addr: Bcast: Mask: inet6 addr: fe80::20c:29ff:fe0a:c39d/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:9000 Metric:1 RX packets: errors:0 dropped:1468 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes: (628.1 GB) TX bytes: (694.0 GB) eth2 Link encap:ethernet HWaddr 00:0c:29:0a:c3:a7 inet addr: Bcast: Mask: inet6 addr: fe80::20c:29ff:fe0a:c3a7/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets: errors:0 dropped:584 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes: (37.1 GB) TX bytes: (41.4 GB) eth0:mgmtip Link encap:ethernet HWaddr 00:0c:29:0a:c3:93 inet addr: Bcast: Mask: UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 lo Link encap:local Loopback inet addr: Mask: inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets: errors:0 dropped:0 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes: (26.7 GB) TX bytes: (26.7 GB) Type stcli cluster reregister --vcenter-datacenter <dc-name> --vcenter-cluster <clustername> --vcenter-url <vcenter FQDN or IP> --vcenter-user or AD account with vcenter adminstrator privileges> --vcenter-password <vcenter-user password, optional> to reregister the HX cluster with vcenter stcli cluster reregister --vcenter-datacenter hx-4-dc --vcenter-cluster hx-4-cluster --vcenter-url hx-4-vcsa.sjs.local --vcenter-user --vcenter-password <vcenter-user password> Reregister StorFS cluster with a new vcenter... Cluster reregistration with new vcenter succeeded 8. Login to vcenter and Confirm the HXDP Plugin Is Accessible SECTION V: Install Certificates for Different Browsers - Google Chrome, Mozilla FireFox 1. Google Chrome Certificate Installation Launch Google Chrome and select the Customize and control Google Chrome icon and click Settings

29 Expand the Advanced settings and select Manage certificates

30 Select Trusted Root Certification Authorities tab and click Import...

31 When the Certificate Import Wizard window appears, click Next

32 At the File to Import page, click Browse...

33 When the Open window appears, locate the certificate or certificate chain and select the file, confirm the name populates the File Name textbox, and click Open

34 Back at the File to Import page, click Next

35 At the Certificate Store page, confirm Place all certificates in the following store is selected and the Trusted Root Certification Authorities is listed for the Certificate Store, then click Next

36 At the Completing the Certificate Import Wizard, confirm the configuration and click Finish

37 When the Certificate Import Wizard appears, click OK 2. Mozilla FireFox Certificate Installation Launch Google Chrome and select theopen Menu iconand clickoptions

38 In the Privacy & Security section under Certificates, click View Certificates...

39 When the Certificate Manager window appears, select the Authorities tab and click Import... Locate the CA certificate or certificate chain, select the file, confirm it populates the File Name text box, and click Open

40 When the Downloading Certificate windows appears, check the appropriate checkboxes and click OK Trust this CA to identify websites Trust this CA to identify users (If applicable)

41 Back at the Certificate Manager, confirm the CA certificate is present under Authorities and then click OK SECTION VI: Verify HX Connect Certificate Validity Launch Google Chrome and Mozilla FireFox Type FQDN or SCVM CMIP FQDN> to confirm the connection now shows Secure 1. Google Chrome Verification

42

43 2. Mozilla FireFox Verification REFERENCES Cisco HX Data Platform Security Hardening Guide Version 3.0