openstack
/
octavia
Code Issues Proposed changes

Update scripts to use fips allowed algorithms 

Openssl genrsa is deprecated in favor of genpkey, and fails in FIPS mode.
Update the relevant calls to use genpkey instead.

Change-Id: I1aab9faa8afe845e445e620d1800785d2e19ad1e
This commit is contained in:
Ade Lee 2021-09-15 16:51:07 -04:00
parent 27e5b27d31
commit 36a642d9d0
3 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
bin/create_dual_intermediate_CA.sh
View File

@ -44,7 +44,7 @@ touch index.txt
echo 1000 > serial
# Create the client CA private key
openssl genrsa -aes128 -out private/ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 private/ca.key.pem
# Create the client CA root certificate
@ -58,7 +58,7 @@ touch intermediate_ca/index.txt
echo 1000 > intermediate_ca/serial
# Create the client intermediate CA private key
openssl genrsa -aes128 -out intermediate_ca/private/intermediate.ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out intermediate_ca/private/intermediate.ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 intermediate_ca/private/intermediate.ca.key.pem
# Create the client intermediate CA certificate signing request
@ -71,7 +71,7 @@ openssl ca -config ../../openssl.cnf -name CA_intermediate -extensions v3_interm
cat intermediate_ca/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate_ca/ca-chain.cert.pem
###### Create the client key and certificate
openssl genrsa -aes128 -out intermediate_ca/private/controller.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out intermediate_ca/private/controller.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 intermediate_ca/private/controller.key.pem
# Create the client controller certificate signing request
@ -103,7 +103,7 @@ touch index.txt
echo 1000 > serial
# Create the server CA private key
openssl genrsa -aes128 -out private/ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 private/ca.key.pem
# Create the server CA root certificate
@ -117,7 +117,7 @@ touch intermediate_ca/index.txt
echo 1000 > intermediate_ca/serial
# Create the server intermediate CA private key
openssl genrsa -aes128 -out intermediate_ca/private/intermediate.ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out intermediate_ca/private/intermediate.ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 intermediate_ca/private/intermediate.ca.key.pem
# Create the server intermediate CA certificate signing request

6
bin/create_single_CA_intermediate_CA.sh
View File

@ -44,7 +44,7 @@ touch index.txt
echo 1000 > serial
# Create the client CA private key
openssl genrsa -aes128 -out private/ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 private/ca.key.pem
# Create the client CA root certificate
@ -58,7 +58,7 @@ touch intermediate_ca/index.txt
echo 1000 > intermediate_ca/serial
# Create the client intermediate CA private key
openssl genrsa -aes128 -out intermediate_ca/private/intermediate.ca.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out intermediate_ca/private/intermediate.ca.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 intermediate_ca/private/intermediate.ca.key.pem
# Create the client intermediate CA certificate signing request
@ -71,7 +71,7 @@ openssl ca -config ../../openssl.cnf -name CA_intermediate -extensions v3_interm
cat intermediate_ca/certs/intermediate.cert.pem certs/ca.cert.pem > intermediate_ca/ca-chain.cert.pem
###### Create the client key and certificate
openssl genrsa -aes128 -out intermediate_ca/private/controller.key.pem -passout pass:not-secure-passphrase 2048
openssl genpkey -algorithm RSA -out intermediate_ca/private/controller.key.pem -aes-128-cbc -pass pass:not-secure-passphrase
chmod 400 intermediate_ca/private/controller.key.pem
# Create the client controller certificate signing request

6
doc/source/admin/guides/certificates.rst
View File

@ -142,7 +142,7 @@ can be used to create the required certificates.
.. code-block:: bash
$ openssl genrsa -aes256 -out private/ca.key.pem 4096
$ openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pkeyopt rsa_keygen_bits:4096
$ chmod 400 private/ca.key.pem
7. Create the `server` CA certificate.
@ -174,7 +174,7 @@ can be used to create the required certificates.
.. code-block:: bash
$ openssl genrsa -aes256 -out private/ca.key.pem 4096
$ openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pkeyopt rsa_keygen_bits:4096
$ chmod 400 private/ca.key.pem
10. Create the `client` CA certificate.
@ -199,7 +199,7 @@ can be used to create the required certificates.
.. code-block:: bash
$ openssl genrsa -aes256 -out private/client.key.pem 2048
$ openssl genpkey -algorithm RSA -out private/ca.key.pem -aes-128-cbc -pkeyopt rsa_keygen_bits:2048
12. Create the certificate request for the `client` certificate used on the
controllers.