Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
From: John Kinsella <jlkinsel@gmail.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_029D4560-CA37-4A0E-8451-B800D5A7414F"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: [DISCUSS][PROPOSAL] CA authority plugin definition
Date: Fri, 14 Apr 2017 10:21:37 -0700
References: <7205EFD7-C918-43B9-ABB1-2717465D90D9@shapeblue.com>
 <BN6PR02MB33310F929F41B7628BC7612FA9050@BN6PR02MB3331.namprd02.prod.outlook.com>
To: "<dev@cloudstack.apache.org>" <dev@cloudstack.apache.org>
In-Reply-To: <BN6PR02MB33310F929F41B7628BC7612FA9050@BN6PR02MB3331.namprd02.prod.outlook.com>
Message-Id: <51A21084-0907-4773-B7A0-3E5DE876F791@gmail.com>
archived-at: Fri, 14 Apr 2017 17:21:51 -0000

--Apple-Mail=_029D4560-CA37-4A0E-8451-B800D5A7414F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

I=E2=80=99d suggest taking a look at using Dogtag[1] as well. Actually, =
that=E2=80=99s what the Other Guys also suggest[2].

1: http://pki.fedoraproject.org/wiki/PKI_Main_Page =
<http://pki.fedoraproject.org/wiki/PKI_Main_Page>
2: https://wiki.openstack.org/wiki/PKI =
<https://wiki.openstack.org/wiki/PKI>


> On Apr 14, 2017, at 7:57 AM, Simon Weller <sweller@ena.com> wrote:
>=20
> Daan,
>=20
>=20
> What about integrating some like Vault =
(https://github.com/hashicorp/vault =
<https://github.com/hashicorp/vault>)?
>=20
>=20
> - Si
>=20
> ________________________________
> From: Daan Hoogland <daan.hoogland@shapeblue.com =
<mailto:daan.hoogland@shapeblue.com>>
> Sent: Friday, April 14, 2017 5:46 AM
> To: dev@cloudstack.apache.org <mailto:dev@cloudstack.apache.org>
> Subject: [DISCUSS][PROPOSAL] CA authority plugin definition
>=20
> Devs,
>=20
> Following a discussion with a client they came up with the idea to =
create a pluggable CA-framework. A plugin would serve components in =
cloudstack that so require (management servers, agents, load balancers, =
SVMs, etc.) with certificates answering certificate requests and =
validating certificates on request.
>=20
> A default plugin can be written that serves according to its own self =
signed root certificate and have its own revocation list to be managed =
by the admin. Other plugin could forward by mail or web requests to =
external parties.
>=20
> A CA-plugin will have to
>=20
> -          Setup, for the default this means creating its certificate, =
for others it might mean install an intermediate certificate or =
configure a mail, or website address.
>=20
> -          Accept and answer certificate requests
>=20
> o    For client certificates
>=20
> o    For server certificates
>=20
> -          Accept revocation requests
>=20
> -          Validate a connection request according to origin and =
certificate and <extra data>. What extra data is is defined by the =
plugin and can be credentials or field-definitions referring the x509 =
entries or for instance port numbers allowed=E2=80=A6 this is basically =
free to the implementer.
>=20
> A next step will have to be integrating the request calls with =
installs on targets but I think as is this feature merits itself as it =
could be used with out of band configuration management tools as well.
>=20
> Any thoughts, remarks and critiques are welcome,
>=20
> daan.hoogland@shapeblue.com
> www.shapeblue.com <http://www.shapeblue.com/><http://www.shapeblue.com =
<http://www.shapeblue.com/>>
> Shapeblue - The CloudStack Company<http://www.shapeblue.com/ =
<http://www.shapeblue.com/>>
> www.shapeblue.com <http://www.shapeblue.com/>
> Background Cloudstack relies on a fixed download site when it fetches =
the built-in guest VM templates. That download site has historically
>=20
>=20
>=20
> 53 Chandos Place, Covent Garden, London  WC2N 4HSUK
> @shapeblue


--Apple-Mail=_029D4560-CA37-4A0E-8451-B800D5A7414F--