Added information about appliance certificates #677

stuclem · 2017-08-29T12:15:03Z

Fixes #526

Towards #424

@zjs I seem to have adopted you as my go-to guy for all things security related. Can you please review? Thanks!

zjs

http://<i>vic_appliance_address</i>

Should these addresses be http or https? (I don't know how this aspect of VIC works, but if we can recommend https it seems like we should.)

zjs · 2017-08-29T18:32:14Z

docs/user_doc/vic_vsphere_admin/ts_cert_error.md

+
+2. Delete any client certificates or CAs for older instances of vSphere Integrated Containers appliances or VCHs.
+3. Clear the browser history, close, and restart Chrome.
+4. Connect to the vSphere Integrated Containers Getting Started page, vSphere Integrated Containers Management Portal, or VCH Administration portal again, and trust the certificate.


and trust the certificate

Do we have existing documentation we should refer to for this step? Should users blindly trust whatever certificate is presented, or do we recommend a process for verifying that the expected certificate is presented?

That's a good point. PR #663 includes details about how to verify the VC/ESXi cert, but we need similar information for the appliance and VCH certs. Will investigate. Thanks @zjs !

stuclem · 2017-08-30T08:59:16Z

Thanks @zjs. Regarding HTTP vs HTTPS, there is now a redirect in place, so if you just enter http://vic_appliance_address it sends you automatically to the Getting Started page at https://vic_appliance_address:9443.

stuclem · 2017-08-30T10:34:28Z

@zjs I added a line that users should verify the certificate before trusting it, but don't yet include details about how they might do that. @andrewtchin, is there a way for users to see an auto-generated self-signed certificate for the OVA appliance so that they can check it, rather than just blindly accepting it?

stuclem · 2017-08-30T10:37:12Z

@andrewtchin if users just examine the cert in Firefox or Chrome, is there something that they should check to make sure that it's legit? Can they download the cert from anywhere and install it, so that they don't see the security warning any more?

andrewtchin · 2017-08-30T14:31:45Z

docs/user_doc/vic_vsphere_admin/ts_cert_error.md

@@ -0,0 +1,27 @@
+# Browser Rejects Certificates with `ERR_CERT_INVALID` Error #
+
+Attempts to connect to vSphere Integrated Containers web interfaces fail with certificate errors in Google Chrome browsers.


I would assume other browsers too if using self signed certs

Hmm now that I read further down, based on the inbound links to this ts, it may be worthwhile to distinguish this from the CA not being recognized error that all users using self signed certs will see

My thought is that it is limited to Chrome. Firefox, for example, warns you that the connection isn't secure but then allows you to make an exception for this site. Chrome just locks you out.

andrewtchin · 2017-08-30T14:37:40Z

@stuclem they would have to SSH in or use the console to the appliance and look at the certificate. They could then compare it to what appears in their browser. With the self signed cert the user can't determine its legitimacy by just looking in their browser - they either need to compare to what's on the appliance or trust the CA. To trust the CA they also need to SSH in to the appliance to obtain the CA certificate. We can document how to do this - let me know.

stuclem · 2017-08-30T15:26:35Z

@andrewtchin yes I think that this is definitely worth documenting. I matches what we are adding to the docs about verifying the VC/ESXi hosts, i.e. SSH in and examine the cert.

andrewtchin · 2017-08-30T16:54:50Z

I'll get you a draft for this. I also added a task to display the fingerprint on the DCUI once we share a single cert amongst all components on the appliance. When this is implemented the user would only need to use the vSphere console to verify the self signed cert

andrewtchin · 2017-08-30T22:36:56Z

To verify Getting Started Page self-signed certificate

Navigate to the Getting Started Page at https://<appliance IP>:9443
View the certificate details in the browser (steps vary by browser) and locate the SHA-256 Fingerprint
Use SSH or DCUI to access the VIC appliance console and login
Execute openssl x509 -in /opt/vmware/fileserver/cert/server.crt -noout -sha256 -fingerprint
Compare the output of this command to the SHA-256 Fingerprint displayed in the browser - they should be equal

To trust the certificate authority used to sign Getting Started Page self-signed certificate

Use SSH or DCUI to access the VIC appliance console and login
Copy the file /opt/vmware/fileserver/cert/ca.crt to the machine you want to trust the CA on
Follow OS specific procedures to add the copied ca.crt to the root certificate store on the machine

To verify Admiral and Harbor self-signed certificate

After VIC Appliance is initialized, navigate to https://<appliance IP>:8282
View the certificate details in the browser (steps vary by browser) and locate the SHA-256 Fingerprint
Use SSH or DCUI to access the VIC appliance console and login
Execute openssl x509 -in /data/admiral/cert/server.crt -noout -sha256 -fingerprint
Compare the output of this command to the SHA-256 Fingerprint displayed in the browser - they should be equal

To trust the certificate authority used to sign Admiral and Harbor self-signed certificate

Use SSH or DCUI to access the VIC appliance console and login
Copy the file /data/admiral/cert/ca.crt to the machine you want to trust the CA on
Follow OS specific procedures to add the copied ca.crt to the root certificate store on the machine

Note: the separate procedure won't be needed after vmware/vic#5640
Also the Demo VCH installer generates the cert each time it starts and doesn't save it to disk so we can't really do anything about verifying that at this point.

stuclem · 2017-08-31T07:08:28Z

Fabulous, thank you @andrewtchin !

stuclem · 2017-08-31T14:45:25Z

This PR has morphed into a general update of certificates information.

@andrewtchin I rejigged your contribution above to divide it into what the vSphere Admin does and what anyone who logs in to the VIC MP does. I also attempted to add a reference for all of the certificates at play in VIC. Do we need to bring anyone else in to review this now more-extensive-than-expected PR?

andrewtchin · 2017-08-31T14:58:27Z

@zjs would be good to review this. Zach, what do you think about verifying the self signed certificate by looking at the SHA1 fingerprint vs SHA256?

stuclem · 2017-08-31T15:10:23Z

@andrewtchin ah yes, I changed it from SHA256 to SHA1 because Chrome doesn't show the SHA-256 thumbprint, at least as far as I could find.

andrewtchin · 2017-08-31T15:16:46Z

it's not easily accessible - it's at the bottom

zjs · 2017-09-01T16:57:32Z

Zach, what do you think about verifying the self signed certificate by looking at the SHA1 fingerprint vs SHA256?

This seems like a classic security vs. usability question. Checking the SHA-256 fingerprint would be more secure, but if we make the procedure too hard/complicated its less likely people will follow it at all. Given that, and given the specific way that SHA-1 has been broken in practice, I think we're fine providing instructions using the SHA-1 thumprint for now.

andrewtchin · 2017-09-01T17:01:53Z

Agreed on all points

stuclem · 2017-09-04T11:57:01Z

OK thanks @zjs. So are you good to go on this PR? Did you review the content, specifically docs/user_doc/vic_vsphere_admin/vic_cert_reference.md? Thanks!

zjs

This generally looks good to me.

zjs · 2017-09-06T21:54:04Z

docs/user_doc/vic_vsphere_admin/vic_cert_reference.md

+|vCenter Server or ESXi host|Self-signed or custom|Required for installation of the vSphere Client plug-ins and deployment and management of virtual container hosts (VCHs). See [Obtain the Certificate Thumbprint of vCenter Server or an ESXi Host](obtain_thumbprint.md).|vSphere administrator|
+|vSphere Integrated Containers Management Portal|Self-signed or custom|Authenticates connections from browsers to vSphere Integrated Containers Management Portal. See [Obtain the Thumbprints and CA Files of the vSphere Integrated Containers Appliance Certificates](obtain_appliance_certs.md) and [Verify and Trust vSphere Integrated Containers Appliance Certificates](../vic_cloud_admin/trust_vic_certs.md).|Cloud and DevOps admininistrators, developers|
+|vSphere Integrated Containers Registry|Self-signed|Authenticates connections to vSphere Integrated Containers Registry instances from Docker clients, replication of projects between registry instances, and registration of additional registry instances in the management portal. See [Configure System Settings](../vic_cloud_admin/configure_system.md).|Cloud and DevOps admininistrators, developers|
+|vSphere Integrated Containers file server|Self-signed or custom|Authenticates connections to the Getting Started page, downloads of vSphere Integrated Containers Engine binaries, and the installation of vSphere Client plug-ins. See [Obtain the Thumbprints and CA Files of the vSphere Integrated Containers Appliance Certificates](obtain_appliance_certs.md) and [Verify and Trust vSphere Integrated Containers Appliance Certificates](../vic_cloud_admin/trust_vic_certs.md).|vSphere administrator, Cloud and DevOps admininistrators, developers|


vSphere Integrated Containers file server

I wonder if we have a better external name for this component, but I'm not sure what it would be.

That's what we've been calling it everywhere. I am trying (and failing) to think of a better name...

zjs · 2017-09-06T21:55:38Z

docs/user_doc/vic_vsphere_admin/vic_cert_reference.md

+|vSphere Integrated Containers Management Portal|Self-signed or custom|Authenticates connections from browsers to vSphere Integrated Containers Management Portal. See [Obtain the Thumbprints and CA Files of the vSphere Integrated Containers Appliance Certificates](obtain_appliance_certs.md) and [Verify and Trust vSphere Integrated Containers Appliance Certificates](../vic_cloud_admin/trust_vic_certs.md).|Cloud and DevOps admininistrators, developers|
+|vSphere Integrated Containers Registry|Self-signed|Authenticates connections to vSphere Integrated Containers Registry instances from Docker clients, replication of projects between registry instances, and registration of additional registry instances in the management portal. See [Configure System Settings](../vic_cloud_admin/configure_system.md).|Cloud and DevOps admininistrators, developers|
+|vSphere Integrated Containers file server|Self-signed or custom|Authenticates connections to the Getting Started page, downloads of vSphere Integrated Containers Engine binaries, and the installation of vSphere Client plug-ins. See [Obtain the Thumbprints and CA Files of the vSphere Integrated Containers Appliance Certificates](obtain_appliance_certs.md) and [Verify and Trust vSphere Integrated Containers Appliance Certificates](../vic_cloud_admin/trust_vic_certs.md).|vSphere administrator, Cloud and DevOps admininistrators, developers|
+|VCHs|None, self-signed, or custom|Authenticates connections from Docker clients to VCHs. See [VCH Deployment Options](vch_installer_options.md#security).|vSphere administrator, Cloud and DevOps admininistrators, developers |


VCHs

Nit-pick: this seems to be the only plural row (even though we expect that we may have more than one of other things, like ESXi hosts). Maybe it should just be "VCH" for consistency?

You're right. Fixed in 91f1818. And I like nit-picky!

Added troubleshooting topic about browser cert errors

ba1aa9d

stuclem requested a review from zjs August 29, 2017 12:15

vmwclabot added the cla-not-required label Aug 29, 2017

Adding new topic on Chrome certs

695417f

zjs reviewed Aug 29, 2017

View reviewed changes

Informed users to validate cert before trusting

82d9917

andrewtchin reviewed Aug 30, 2017

View reviewed changes

Adding info about validating appliance certs

1bb61ce

stuclem changed the title ~~Added troubleshooting topic about browser cert errors~~ Added information about appliance certificates Aug 31, 2017

andrewtchin approved these changes Aug 31, 2017

View reviewed changes

zjs approved these changes Sep 6, 2017

View reviewed changes

stuclem added 2 commits September 7, 2017 09:33

Minor comment from Zach.

91f1818

Merge branch 'master' into chromecert

d4d0f10

stuclem merged commit e40c902 into vmware:master Sep 7, 2017

stuclem deleted the chromecert branch September 7, 2017 07:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added information about appliance certificates #677

Added information about appliance certificates #677

stuclem commented Aug 29, 2017 •

edited

Loading

zjs left a comment

zjs Aug 29, 2017

stuclem Aug 30, 2017

stuclem commented Aug 30, 2017

stuclem commented Aug 30, 2017

stuclem commented Aug 30, 2017 •

edited

Loading

andrewtchin Aug 30, 2017

andrewtchin Aug 30, 2017

stuclem Aug 30, 2017

andrewtchin commented Aug 30, 2017

stuclem commented Aug 30, 2017

andrewtchin commented Aug 30, 2017

andrewtchin commented Aug 30, 2017 •

edited

Loading

stuclem commented Aug 31, 2017

stuclem commented Aug 31, 2017

andrewtchin commented Aug 31, 2017

stuclem commented Aug 31, 2017

andrewtchin commented Aug 31, 2017

zjs commented Sep 1, 2017

andrewtchin commented Sep 1, 2017

stuclem commented Sep 4, 2017

zjs left a comment

zjs Sep 6, 2017

stuclem Sep 7, 2017

zjs Sep 6, 2017

stuclem Sep 7, 2017

		@@ -0,0 +1,27 @@
		# Browser Rejects Certificates with `ERR_CERT_INVALID` Error #

		Attempts to connect to vSphere Integrated Containers web interfaces fail with certificate errors in Google Chrome browsers.

Added information about appliance certificates #677

Added information about appliance certificates #677

Conversation

stuclem commented Aug 29, 2017 • edited Loading

zjs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stuclem commented Aug 30, 2017

stuclem commented Aug 30, 2017

stuclem commented Aug 30, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrewtchin commented Aug 30, 2017

stuclem commented Aug 30, 2017

andrewtchin commented Aug 30, 2017

andrewtchin commented Aug 30, 2017 • edited Loading

To verify Getting Started Page self-signed certificate

To trust the certificate authority used to sign Getting Started Page self-signed certificate

To verify Admiral and Harbor self-signed certificate

To trust the certificate authority used to sign Admiral and Harbor self-signed certificate

stuclem commented Aug 31, 2017

stuclem commented Aug 31, 2017

andrewtchin commented Aug 31, 2017

stuclem commented Aug 31, 2017

andrewtchin commented Aug 31, 2017

zjs commented Sep 1, 2017

andrewtchin commented Sep 1, 2017

stuclem commented Sep 4, 2017

zjs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stuclem commented Aug 29, 2017 •

edited

Loading

stuclem commented Aug 30, 2017 •

edited

Loading

andrewtchin commented Aug 30, 2017 •

edited

Loading