IP SAN requirement for CA cert used in SCO. - #1112
Conversation
|
|
||
| The public certificate and CA certificate are configured on the conductor at the Authority level. | ||
|
|
||
| Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for each router that is onboarding to the conductor. This requires that the certificate issued by the CA includes includes the IP SAN, which allows the conductor to perform validation and authentication. |
There was a problem hiding this comment.
Does the IP SAN need to match any fields in the configuration relating to the router? If so, that would be worth mentioning here as well, unless that is otherwise fully covered in the related link.
There was a problem hiding this comment.
The SAN(s) would need to match the conductor IPs that are configured in the mist redirect site. The API is /api/v1/sites/<site>/setting and the relevant subset of the content looks like this:
{
"ssr": {
"conductor_hosts": ["10.92.53.7", "10.92.54.7"],
"conductor_token": "<sco-token>"
}
}The IP SAN would need to include those conductor_hosts IPs as they are what the router will use to connect to the conductor.
There was a problem hiding this comment.
My prior comment was specific to redirect. More generically, the relevant config would be the authority -> conductor-address list which specifies addresses routers should use to reach the conductor.
|
|
||
| The public certificate and CA certificate are configured on the conductor at the Authority level. | ||
|
|
||
| Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for each router that is onboarding to the conductor. This requires that the certificate issued by the CA includes includes the IP SAN, which allows the conductor to perform validation and authentication. |
There was a problem hiding this comment.
"for each router" makes it sound like the SAN is required multiple times. But it's only a requirement for the conductor's certificate (more of a one-time thing). I'd say ...for routers to securely identify the conductor's identity. The second sentence would need a similar adjustment as the SAN is for router's authenticating the conductor, not vice verse.
I'd also call out that multiple IP SAN entries are required for HA conductors (one for each node).
e5f97bd
…rding procedure from I95-65820.
bfab5c8
4 participants
No description provided.