Using a Let's Encrypt certificate with Uyuni?

[johanneskastl]

Hi everyone,

I tried to find an answer in the Uyuni SSL documentation but failed to find a clear statement on this:

Does Uyuni need a simple TLS certificate, so it is possible to use one from e.g. Let's Encrypt?
Or does it need a CA certificate because it creates/signs other keys with this certificate?

If the former is the case, would it be enough to replace /etc/pki/tls/certs/spacewalk.crt and /etc/pki/tls/private/spacewalk.key with the files generated by Let's Encrypt tooling (lego, dehydrated, certbot, ...) and restart Uyuni afterwards?

Thanks in advance.

Kind Regards
Johannes

[mcalmer]

Yes, Let's Encrypt certificates should work, but it is more than just replace cert and key.
Just follow:
https://www.uyuni-project.org/uyuni-docs/en/uyuni/administration/ssl-certs-imported.html#_replace_certificates

Be careful. AFAIK Let's Encrypt uses intermediate CAs. You need to provide them correctly to mgr-ssl-cert-setup.

[johanneskastl]

Thanks for the reply, Michael. I tested it this morning, but it looks like Uyuni does not like the EC certificate that Let's Encrypt issues (by default apparently, see the file output below).

Invalid RSA Key: 140248263792448:error:0607907F:digital envelope routines:EVP_PKEY_get0_RSA:expecting an rsa key:crypto/evp/p_lib.c:469:

root XXX:/root # file /etc/ssl/uyuni/certificates/*
/etc/ssl/uyuni/certificates/<redacted>.crt:        PEM certificate
/etc/ssl/uyuni/certificates/<redacted>.issuer.crt: ASCII text
/etc/ssl/uyuni/certificates/<redacted>.json:       ASCII text
/etc/ssl/uyuni/certificates/<redacted>.key:        PEM EC private key
root XXX:/root #

I'll see if I can get Let's Encrypt to issue a RSA certificate and test again.

[johanneskastl]

I got lego to request a RSA4096 certificate, and after some fiddling I could successfully get mgr-ssl-cert-setup to accept it.

[...]
TLS_INTERMEDIATE_CA_FILE='/etc/ssl/lets-encrypt-r3.pem'
TLS_CA_FILE='/var/lib/ca-certificates/pem/ISRG_Root_X1.pem'
echo "Running mgr-ssl-cert-setup"
mgr-ssl-cert-setup \
    --root-ca-file="${TLS_CA_FILE}" \
    --intermediate-ca-file="${TLS_INTERMEDIATE_CA_FILE}" \
    --server-cert-file="${TLS_CERT_FILE}" \
    --server-key-file="${TLS_KEY_FILE}" || {
    echo "Error during mgr-ssl-cert-setup"
    exit 21
}
[...]

I did not find a suitable R3 intermediate certificate file, neither in /var/lib/ca-certificates/pem/ nor in the automatically created files by lego. But I downloaded it manually and it seemed to work.

Stay tuned for the certificate renewal in 60 days... :-)

[mcalmer]

I started to add support for EC cryptographic certificates in #7266 .
Feel free to give it a try and report back

[johanneskastl]

Thanks Michael! I won't have time to test, unfortunately. And I already replaced the certificate with a RSA one...