Security settings¶

Setting subject data for self-signed certificates¶

Change the subject data of any self-signed certificate by using configuration variables. The configuration variable for each service is formatted as <servicename>_ssl_self_signed_subject. For example, to change the SSL certificate subject data for HAProxy, adjust the /etc/openstack_deploy/user_variables.yml file as follows:

haproxy_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN=haproxy.example.com"

For more information about the available fields in the certificate subject, see the OpenSSL documentation for the req subcommand.

Generating and regenerating self-signed certificates¶

Self-signed certificates are generated for each service during the first run of the playbook.

To generate a new self-signed certificate for a service, you must set the <servicename>_ssl_self_signed_regen variable to true in one of the following ways:

• To force a self-signed certificate to regenerate, you can pass the variable to openstack-ansible on the command line:

  # openstack-ansible -e "horizon_ssl_self_signed_regen=true" os-horizon-install.yml
  

• To force a self-signed certificate to regenerate with every playbook run, set the appropriate regeneration option to true. For example, if you have already run the haproxy playbook, but you want to regenerate the self-signed certificate, set the haproxy_ssl_self_signed_regen variable to true in the /etc/openstack_deploy/user_variables.yml file:

  haproxy_ssl_self_signed_regen: true
  

HAProxy example¶

The variables to set which provide the path on the deployment node to the certificates for HAProxy configuration are:

haproxy_user_ssl_cert: /etc/openstack_deploy/ssl/example.com.crt
haproxy_user_ssl_key: /etc/openstack_deploy/ssl/example.com.key
haproxy_user_ssl_ca_cert: /etc/openstack_deploy/ssl/ExampleCA.crt

RabbitMQ example¶

To deploy user-provided certificates for RabbitMQ, copy the certificates to the deployment host, edit the /etc/openstack_deploy/user_variables.yml file and set the following three variables:

rabbitmq_user_ssl_cert:    /etc/openstack_deploy/ssl/example.com.crt
rabbitmq_user_ssl_key:     /etc/openstack_deploy/ssl/example.com.key
rabbitmq_user_ssl_ca_cert: /etc/openstack_deploy/ssl/ExampleCA.crt

Then, run the playbook to apply the certificates:

# openstack-ansible rabbitmq-install.yml

The playbook deploys your user-provided SSL certificate, key, and CA certificate to each RabbitMQ container.

The process is identical for the other services. Replace rabbitmq in the preceding configuration variables with horizon, haproxy, or keystone, and then run the playbook for that service to deploy user-provided certificates to those services.

[ English | Deutsch | 한국어 (대한민국) | English (United Kingdom) | Indonesia ]