Need for documentation of required characteristics for user supplied CA certificates

[Frode Nordahl]

When deploying with Vault the user may choose to supply their own intermediate CA certificate.

For successful operation certain characteristics about the certificate must be correct otherwise one may run into obscure failures further down the line.

In an OpenStack deployment certificates are used both for TLS Web Server Authentication as well as Client Authentication.

Client Authentication is used between OVN OVSDB Servers, between OVSDB Servers and control plane clients.

At present certificates for the private client-/server- communication between Octavia and its amphora is not automated with Vault, but if you choose to use a CA certificate that does not allow Client authentication in the certificate chain for the certs used between the Octavia worker and its Amphorae it will not work.

If the provided CA certificate does not allow for both server and client authentication the deployment will fail.

To demonstrate the issue you can modify the certificate generation in our test suite like this:
--- /home/frode/src/github.com/openstack-charmers/zaza-openstack-tests/zaza/openstack/utilities/cert.py 2021-01-18 21:21:51.129458513 +0100
+++ .tox/func-smoke/lib/python3.9/site-packages/zaza/openstack/utilities/cert.py2021-01-26 12:33:31.800475831 +0100
@@ -122,6 +122,11 @@
         cryptography.x509.BasicConstraints(ca=generate_ca, path_length=None),
         critical=True,
     )
+ builder = builder.add_extension(
+ cryptography.x509.ExtendedKeyUsage([
+ cryptography.x509.oid.ExtendedKeyUsageOID.SERVER_AUTH]),
+ critical=True,
+ )

     if signing_key:
         sign_key = _signing_key

Which will make the services that require client authentication fail.

[Frode Nordahl (fnordahl)]

Would also be good to have a way for charms that require client certificate authentication to check whether the provided certificate allows for it.

As per the upstream documentation [0] the Vault secrets PKI engine allows a client to provide both a `server_flag` and a `client_flag` which would produce an immediate error if the properties of the CA does not allow for either.

However, this detail is hidden from the tls-certificates interface [1] and Vault charm [2].

So either we have to fix the interface and vault charm to be able to express this detail or we have to add a common function in some framework so that we can perform the check when required.

0: https://www.vaultproject.io/api-docs/secret/pki#create-update-role
1: https://github.com/juju-solutions/interface-tls-certificates
2: https://github.com/openstack/charm-vault

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-deployment-guide/+/837417
Committed: https://opendev.org/openstack/charm-deployment-guide/commit/9c06b031283b6f17726aa9a7c6db2c055239608d
Submitter: "Zuul (22348)"
Branch: master

commit 9c06b031283b6f17726aa9a7c6db2c055239608d
Author: Tianqi <email address hidden>
Date: Mon Apr 11 21:19:51 2022 +0000

    Add guide for switching between different types of certificates

    Add the steps for swtiching between self-signed CA certificate
    and third-party intermediate CA certificate after Vault charm
    deployment. A note asking user to check the level of authorization
    of the intermediate CA certificate is also added.

    Closes-Bug: #1913289
    Change-Id: I9e8ca51759650d211f491457cb0d0fc0040358e8