Created sec_adcs_certificates.rst #583

tsluyter · 2019-02-21T10:46:49Z

Jan requested that I describe my process of using ADCS to generate keys and certificates for the Graylog stack. This document is the first iteration of said documentation.

CLAassistant · 2019-02-21T10:46:57Z

All committers have signed the CLA.

tsluyter

Looking good! Thanks for the fixes! I cannot approve them in Github, but please go ahead and include these.

ChristopherKB

Looks good. Still way more confusing than it should be, but the docs are good.

ChristopherKB · 2019-02-21T15:23:18Z

pages/secure/sec_adcs_certificates.rst

+Generating the keypair and certificates - preparation
+===============
+
+The following instructions assume that you generate all the keypairs on a Windows administrative workstation, or on the issuing CA itself (meaning, you'll need that extra "*Allow the private key to be exported*" flag). You can of course generate all keys on the Graylog stack servers and then simply submit the CSR (certificate signing request) to the CA.


Change "You can of course generate..." to "You can, of course, generate..."

Suggested change

The following instructions assume that you generate all the keypairs on a Windows administrative workstation, or on the issuing CA itself (meaning, you'll need that extra "*Allow the private key to be exported*" flag). You can of course generate all keys on the Graylog stack servers and then simply submit the CSR (certificate signing request) to the CA.

The following instructions assume that you generate all the keypairs on a Windows administrative workstation, or on the issuing CA itself (meaning, you'll need that extra "*Allow the private key to be exported*" flag). You can, of course, generate all keys on the Graylog stack servers and then simply submit the CSR (certificate signing request) to the CA.

ChristopherKB · 2019-02-21T15:24:44Z

pages/secure/sec_adcs_certificates.rst

+
+For some reason IExplore ignores the *ipaddress* field of the SAN (subject alternative name).
+
+The above is only one of the needed .INF files; you will need one for each keypair being generated! So adjust all relevant fields and save each .INF file separately.


Please bold and italicize the sentence "you will need one for each keypair being generated!"

Suggested change

The above is only one of the needed .INF files; you will need one for each keypair being generated! So adjust all relevant fields and save each .INF file separately.

The above is only one of the needed .INF files; **you will need one for each key pair being generated**! So adjust all relevant fields and save each .INF file separately.

ChristopherKB · 2019-02-21T15:25:41Z

pages/secure/sec_adcs_certificates.rst

+Generating the keypair and certificates - execution
+===============
+
+As said, we're assuming that you're generating the keypairs on your Windows administration station. If you're generating the keypairs on the Graylog Linux hosts, then you will need to use different instructions. 


This sentence is unclear. If you need to use different instructions, where can those instructions be found?

Suggested change

As said, we're assuming that you're generating the keypairs on your Windows administration station. If you're generating the keypairs on the Graylog Linux hosts, then you will need to use different instructions.

As said, we're assuming that you're generating the keypairs on your Windows administration station. If you're generating the key pairs on the Graylog Linux hosts, then you will need to use OpenSSL instructions (`For example <https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs>`_).

ChristopherKB · 2019-02-21T15:27:42Z

pages/secure/sec_adcs_certificates.rst

+      type D:\secrets\graylog\rootca.pem > D:\secrets\graylog\cachain.pem
+      type D:\secrets\graylog\rootca.pem >> D:\secrets\graylog\cachain.pem
+
+The resulting cachain.pem file can be used in all Graylog stack applications for inclusion in the trust store. You will probably need to run the file through **dos2unix** first though, to fix line endings.


Might want to expand this. If you will probably need to do it, the guide should cover how.

Suggested change

The resulting cachain.pem file can be used in all Graylog stack applications for inclusion in the trust store. You will probably need to run the file through **dos2unix** first though, to fix line endings.

The resulting cachain.pem file can be used in all Graylog stack applications for inclusion in the trust store. After uploading the file to Linux, you will need to run the file through **dos2unix** first, to fix line endings.

tsluyter · 2019-02-21T16:25:48Z

You've made some great comments Christopher! I'll try and pick all of those up RSN(tm).

tsluyter · 2019-02-21T17:50:45Z

Hey @ChristopherKB I've added suggestions for each of your comments. Thanks for your time and help.

tsluyter · 2019-02-21T17:52:42Z

Wait, I just realized something important. Ben on the forums pointed out that the PKCS#8 keys are not usable for inputs on Graylog 3.0. Apparently they work differently. So these instructions are 100% guaranteed for <= v2.5. Inputs of 3.0 apparently need additional work.

EDIT:
Maybe I misunderstood Ben. Will need to investigate.

See here.

Created sec_adcs_certificates.rst

ef85096

Jan requested that I describe my process of using ADCS to generate keys and certificates for the Graylog stack. This document is the first iteration of said documentation.

format fix

f290504

tsluyter commented Feb 21, 2019

View reviewed changes

jalogisch added 2 commits February 21, 2019 13:58

fix build

7a851de

fix build (line intend)

32043d9

jalogisch added the ready-for-review label Feb 21, 2019

jalogisch requested a review from ChristopherKB February 21, 2019 13:03

ChristopherKB approved these changes Feb 21, 2019

View reviewed changes

ChristopherKB merged commit f5519e6 into Graylog2:3.0 Feb 21, 2019

	The following instructions assume that you generate all the keypairs on a Windows administrative workstation, or on the issuing CA itself (meaning, you'll need that extra "Allow the private key to be exported" flag). You can of course generate all keys on the Graylog stack servers and then simply submit the CSR (certificate signing request) to the CA.
	The following instructions assume that you generate all the keypairs on a Windows administrative workstation, or on the issuing CA itself (meaning, you'll need that extra "Allow the private key to be exported" flag). You can, of course, generate all keys on the Graylog stack servers and then simply submit the CSR (certificate signing request) to the CA.


		For some reason IExplore ignores the ipaddress field of the SAN (subject alternative name).

		The above is only one of the needed .INF files; you will need one for each keypair being generated! So adjust all relevant fields and save each .INF file separately.

	As said, we're assuming that you're generating the keypairs on your Windows administration station. If you're generating the keypairs on the Graylog Linux hosts, then you will need to use different instructions.
	As said, we're assuming that you're generating the keypairs on your Windows administration station. If you're generating the key pairs on the Graylog Linux hosts, then you will need to use OpenSSL instructions (`For example <https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs>`_).

	The resulting cachain.pem file can be used in all Graylog stack applications for inclusion in the trust store. You will probably need to run the file through dos2unix first though, to fix line endings.
	The resulting cachain.pem file can be used in all Graylog stack applications for inclusion in the trust store. After uploading the file to Linux, you will need to run the file through dos2unix first, to fix line endings.

Created sec_adcs_certificates.rst #583

Created sec_adcs_certificates.rst #583

Uh oh!

Conversation

tsluyter commented Feb 21, 2019

Uh oh!

CLAassistant commented Feb 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tsluyter left a comment

Choose a reason for hiding this comment

Uh oh!

ChristopherKB left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tsluyter commented Feb 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tsluyter commented Feb 21, 2019

Uh oh!

tsluyter commented Feb 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CLAassistant commented Feb 21, 2019 •

edited

Loading

tsluyter commented Feb 21, 2019 •

edited

Loading

tsluyter commented Feb 21, 2019 •

edited

Loading