Has anyone integrated MeshCentral with their own internal PKI?

[kubamaruszczak]

Has anyone replaced MeshCentral’s self-generated certificates (server root, agent server and agent certificates) with ones from their own internal PKI? Is this possible or supported at all?

[NotAFlightRisk]

Possible for all the server certs (only the web one's documented, the rest just need the files dropped in), not for the agent ones. Tested on 1.2.5, everything goes in meshcentral-data:

• Web: replace webserver-cert-public.crt and webserver-cert-private.key, intermediates go in webserver-cert-chain1.crt, chain2 and so on (docs). If cert in config.json doesn't match a name on it, MeshCentral swaps in its own unless keepCerts is true.
• Server root: it signs with this, so it needs the key. Give it a dedicated sub-CA as root-cert-public.crt and root-cert-private.key, with keyCertSign usage (otherwise MeshCentral re-signs it and breaks the chain). On a fresh install it issues the rest from it.
• Agent server: agentserver-cert-public.crt and agentserver-cert-private.key, RSA only (EC crashes it on startup). Agents pin its public key hash, so with a new key they stop connecting until reinstalled. Have your CA sign a CSR from the current agentserver-cert-private.key and they carry on.
• Agents: each one generates its own self-signed cert and there's no supported way to give it one. The server never checks the issuer anyway, the public key hash is just the device ID.

[kubamaruszczak]

Thanks, this is really helpful! Do you keep the private keys as plain files in meshcentral-data, or do you protect them somehow?

[NotAFlightRisk]

By default they're plain PEM files, but 1.2.5 has two ways round that:

• Encrypted keys: convert each one with openssl pkcs8 -topk8 -v2 aes-256-cbc -in webserver-cert-private.key -out webserver-cert-private.key.enc, put it back under the original name, then add "certificatePrivateKeyPassword": ["your-password"] under settings. Works for all the server keys, but the password sits in config.json right next to them.
• Out of the folder altogether: --dbpushconfigfiles --configkey <key> copies config.json and every .key and .crt into the database, AES-256-GCM encrypted. Delete the key and cert files and start with --loadconfigfromdb <key>. Keep config.json on disk though, the port settings in the pushed copy got ignored without it (and it needs your database settings from there if you're not on the default one).

Either way MeshCentral needs a password at start, so you're moving the secret rather than getting rid of it.