Allow to connect to Zeebe with a custom certificate

[barmac]

This adds a flag for custom SSL certificate: --zeebe-ssl-certificate=<path-to-file>.

Protocol http(s) is now required for the contact points of self-hosted Zeebe instances.

Closes #3028

---

How to test this in action

Prerequisites

• Running Docker.
• Installed openssl.

Steps

1. Clone this repo: https://github.com/barmac/zeebe-tls-connection-test
2. In the repo, run npm run cert. This will generate cert.pem file which will be our certificate. Note that you may need to adjust the generate-cert.sh file, namely the /usr/local/opt/openssl/bin/openssl part to work on your OS. This is done specifically for MacOS.
3. Run npm run zeebe in a separate terminal window. This will run locally a Zeebe instance which will use the certificate for SSL.

Flag

Run Camunda Modeler with flag --zeebe-ssl-certificate=<path-to-cert.pem>, and try to deploy and start instance of self-managed C8. Use https://localhost:26500 as the contact point.

System keychain

After the flag part succeeds, add the certificate to the system keychain and make sure to mark it as trusted. Then, run Camunda Modeler with the flag, and try to deploy and start instance as in the previous part.

[barmac]

I just discovered that when we use system certificates, one cannot connect to C8 SaaS anymore 🤡

[barmac]

OK so this is probably because we only fetch some of the certificates. Cf. https://github.com/jfromaniello/mac-ca/blob/master/index.js#L12 <- this part is missing in VSCode, and consequently our implementation.

[barmac]

We need manual tests for each of the platforms (Linux, Windows, Mac):

• self-hosted Zeebe with TLS
• self-hosted Zeebe without TLS
• C8 SaaS

For self-hosted, you can use scripts from https://github.com/barmac/zeebe-tls-connection-test

[barmac]

Artifacts:

• https://camunda-modeler-on-demand.s3.eu-central-1.amazonaws.com/3028-select-certificate-via-flag/camunda-modeler-3028-select-certificate-via-flag-linux-x64.tar.gz
• https://camunda-modeler-on-demand.s3.eu-central-1.amazonaws.com/3028-select-certificate-via-flag/camunda-modeler-3028-select-certificate-via-flag-mac.dmg
• https://camunda-modeler-on-demand.s3.eu-central-1.amazonaws.com/3028-select-certificate-via-flag/camunda-modeler-3028-select-certificate-via-flag-mac.zip
• https://camunda-modeler-on-demand.s3.eu-central-1.amazonaws.com/3028-select-certificate-via-flag/camunda-modeler-3028-select-certificate-via-flag-win-ia32.zip
• https://camunda-modeler-on-demand.s3.eu-central-1.amazonaws.com/3028-select-certificate-via-flag/camunda-modeler-3028-select-certificate-via-flag-win-x64.zip

[barmac]

I am moving this to in progress due to some problems reported in the original issue: #3028 (comment)

[barmac]

This is now ready for review.

[barmac]

We had a meeting about this in which @CatalinaMoisuc suggested we cross link from the flag documentation to the self-managed self-signed certificate docs.

[nikku]

Simple and clean. Thanks for looking into this.

This closes an issue that numerous people came across in C7 already. Good job fixing it (for the future) :).

[barmac]

This closes an issue that numerous people came across in C7 already.

Just for clarification, this is fixed for C8 only. We could fix it for C7 as well, as a separate topic.

[marstamm]

I tested it on linux and I can connect to all distos (SaaS, local TLS, local insecure). Thank you for the setup repo, this helped a lot 👏

[philippfromme]

I was able to test this on Windows.

Steps

1. Install Docker Desktop for Windows
2. Generate certificate through openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 --nodes -addext "subjectAltName=IP:127.0.0.1,DNS:localhost" (should be installed if Git for Windows is installed)
3. Run docker run --rm -p 26500:26500 -e ZEEBE_BROKER_NETWORK_HOST=0.0.0.0 -e ZEEBE_BROKER_GATEWAY_SECURITY_ENABLED=true -e ZEEBE_BROKER_GATEWAY_SECURITY_CERTIFICATECHAINPATH="/usr/local/zeebe/cert.pem" -e ZEEBE_BROKER_GATEWAY_SECURITY_PRIVATEKEYPATH="/usr/local/zeebe/key.pem" --mount type=bind,source="C:/zeebe-tls-connection-test/cert.pem",target="/usr/local/zeebe/cert.pem" --mount type=bind,source="C:/zeebe-tls-connection-test/key.pem",target="/usr/local/zeebe/key.pem" camunda/zeebe:8.0.4 (had to use PowerShell, Git Bash didn't work)
4. Run Camunda Modeler through "Camunda Modeler.exe" --zeebe-ssl-certificate=cert.pem and deploy ✔️
5. Add certificate through certutil.exe -addstore root c:\zeebe-tls-connection-test\cert.pem
6. Run Camunda Modeler and verify ✔️

Works on Windows ✅

[nikku]

Works on all platforms, works for me 👍.

[barmac]

OK so I will merge this and we still need to update the documentation.

[barmac]

OK so I will merge this and we still need to update the documentation.

Done via camunda/camunda-docs#1268