Improve TLS handling with Fuel (hash, upload mechanism)

[Adam Heczko]

With Fuel 7.0 we did a good job and introduced TLS termination of Fuel / nginx, Apache2 / Horizon, HAProxy / API endpoints.
But current implementation still requires at least the following improvements:

1. For self-signed certs, change hash algorithm from SHA1 to SHA256 [1]
2. Provide better certificate and key upload mechanism with Fuel Web, and allow uploading key and certificate in two separate files.

References:
[1] http://techglimpse.com/sha256-hash-certificate-openssl/

[Alex Schultz (alex-schultz)]

#1 was addressed by bug 1488993 and was fixed by Ic2e522f125be6bcb0fdef2b0e2993ca98290503f

[Adam Heczko (aheczko-mirantis)]

Alex, thank you very much for pointing this out.

[Stanislaw Bogatkin (sbogatkin)]

Why it is a bug? I would rather convert this into blueprint, cause there are some changes needed from UI team (need to change interface to upload), Python team (need to change way to save keypair, also need to add some check that key accord to certificate), from Library team to change way keys and certificates will be stored on target nodes.

[Adam Heczko (aheczko-mirantis)]

Good point Stanislav, I'll prepare blueprint covering mentioned above topics.

[Adam Heczko (aheczko-mirantis)]

Hi folks, please take a look at proposed blueprint [1].

[1] https://blueprints.launchpad.net/fuel/+spec/improve-tls-handling

[Alexander Kislitsky (akislitsky)]

We passed SCF in 8.0. Moving the bug to 9.0.