dev: remove use of cfssl and use Nomad CLI for TLS certs. (#16145)

hashicorp · Mar 20, 2023 · aacc7c6 · aacc7c6
1 parent 96740b5
commit aacc7c6
Show file tree

Hide file tree

Showing 25 changed files with 100 additions and 121 deletions.
diff --git a/dev/tls_cluster/README.md b/dev/tls_cluster/README.md
@@ -1 +1,5 @@
-Simply run the Nomad Server and Clients from this directory and the created cluster will be using TLS.
+Simply run the Nomad Server and Clients from this directory and the created
+cluster will be using TLS.
+
+### Certificate Generation
+The TLS certificates and CA are generated using the `nomad tls` subcommands.
diff --git a/dev/tls_cluster/certs/cfssl.json b/dev/tls_cluster/certs/cfssl.json
diff --git a/dev/tls_cluster/certs/cli-key.pem b/dev/tls_cluster/certs/cli-key.pem
diff --git a/dev/tls_cluster/certs/cli.csr b/dev/tls_cluster/certs/cli.csr
diff --git a/dev/tls_cluster/certs/cli.pem b/dev/tls_cluster/certs/cli.pem
diff --git a/dev/tls_cluster/certs/client-key.pem b/dev/tls_cluster/certs/client-key.pem
diff --git a/dev/tls_cluster/certs/client.csr b/dev/tls_cluster/certs/client.csr
diff --git a/dev/tls_cluster/certs/client.pem b/dev/tls_cluster/certs/client.pem
diff --git a/dev/tls_cluster/certs/foo-cli-nomad-key.pem b/dev/tls_cluster/certs/foo-cli-nomad-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIHGAcGoe8PnglGzeYEYsmlDIGHe2C2J+srNrdNthZyU+oAoGCCqGSM49
+AwEHoUQDQgAEbYWATwzycIhU97oDPZv4COfAejWL7GaufaZ2qacHV4xdBQVtny84
+KxLPNo+lInNMlHj16ojkt72+PcO6USSn2w==
+-----END EC PRIVATE KEY-----
diff --git a/dev/tls_cluster/certs/foo-cli-nomad.pem b/dev/tls_cluster/certs/foo-cli-nomad.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICbjCCAhSgAwIBAgIRAOvVUjAwJkYxb/ANpw/Xy6kwCgYIKoZIzj0EAwIwgbcx
+CzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj
+bzEaMBgGA1UECRMRMTAxIFNlY29uZCBTdHJlZXQxDjAMBgNVBBETBTk0MTA1MRcw
+FQYDVQQKEw5IYXNoaUNvcnAgSW5jLjE+MDwGA1UEAxM1Tm9tYWQgQWdlbnQgQ0Eg
+ODI2MDkxNjY3NzA3ODUzNzI5NTUxMTc1Mjk5NTUwOTk4Nzk4NTQwHhcNMjMwMjEz
+MDk0MzQwWhcNMjQwMjEzMDk0MzQwWjAYMRYwFAYDVQQDEw1jbGkuZm9vLm5vbWFk
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbYWATwzycIhU97oDPZv4COfAejWL
+7GaufaZ2qacHV4xdBQVtny84KxLPNo+lInNMlHj16ojkt72+PcO6USSn26OBnjCB
+mzAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADApBgNVHQ4EIgQgyzOAi1r2
+TR2WKbmBqCMZAMIIURiz7JZAwl+tXtuxKG8wKwYDVR0jBCQwIoAgJt7MGCV1pkZL
+mLAvx5NOLsM2WvKnCIqtkk8W8u+Ug4EwIwYDVR0RBBwwGoINY2xpLmZvby5ub21h
+ZIIJbG9jYWxob3N0MAoGCCqGSM49BAMCA0gAMEUCIQDqb1OcWZwdXZ+Jl1G/caSf
+lLNmk6aTp+X/qBDt6Mw6zwIgBR8lwR8mppMU0aIKezKDuLyKx0ED2TWf5A6uxU18
+t0k=
+-----END CERTIFICATE-----
diff --git a/dev/tls_cluster/certs/foo-client-nomad-key.pem b/dev/tls_cluster/certs/foo-client-nomad-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIGG5neP+Z+CPTHGle6MHDeLzKz1h3LpDufWyOi4uJ1SioAoGCCqGSM49
+AwEHoUQDQgAE7NzfNOCytBb9PVC1rkotTiSL09EVrt6KLG2BZRLPhJil9b/JGPsB
+tP5eIVKW4wKLljO1OvTRvwNyupZZkhIovg==
+-----END EC PRIVATE KEY-----
diff --git a/dev/tls_cluster/certs/foo-client-nomad.pem b/dev/tls_cluster/certs/foo-client-nomad.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIICmDCCAj6gAwIBAgIQdAsC8e5Z6xfm6MxAnqvsmDAKBggqhkjOPQQDAjCBtzEL
+MAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MRowGAYDVQQJExExMDEgU2Vjb25kIFN0cmVldDEOMAwGA1UEERMFOTQxMDUxFzAV
+BgNVBAoTDkhhc2hpQ29ycCBJbmMuMT4wPAYDVQQDEzVOb21hZCBBZ2VudCBDQSA4
+MjYwOTE2Njc3MDc4NTM3Mjk1NTExNzUyOTk1NTA5OTg3OTg1NDAeFw0yMzAyMTMw
+OTQzNTFaFw0yNDAyMTMwOTQzNTFaMBsxGTAXBgNVBAMTEGNsaWVudC5mb28ubm9t
+YWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATs3N804LK0Fv09ULWuSi1OJIvT
+0RWu3oosbYFlEs+EmKX1v8kY+wG0/l4hUpbjAouWM7U69NG/A3K6llmSEii+o4HG
+MIHDMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
+AwEwDAYDVR0TAQH/BAIwADApBgNVHQ4EIgQgAUc9ZPq2IoNkE/CoaExqIDn6rjnw
+QokHmxV9HFlKJsIwKwYDVR0jBCQwIoAgJt7MGCV1pkZLmLAvx5NOLsM2WvKnCIqt
+kk8W8u+Ug4EwLAYDVR0RBCUwI4IQY2xpZW50LmZvby5ub21hZIIJbG9jYWxob3N0
+hwR/AAABMAoGCCqGSM49BAMCA0gAMEUCIA1yK8irAMnm+FW0wHMTH4JwBzOwyKaL
++ZbvUn0RI+W7AiEAir7nn9Is6bIAywtf5GjsfWJbkQz2rBv0GrblzQcB3dA=
+-----END CERTIFICATE-----
diff --git a/dev/tls_cluster/certs/foo-server-nomad-key.pem b/dev/tls_cluster/certs/foo-server-nomad-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIL34Rs9pwGYYUoBMDv9YjjkLzHG2n+rRUwPXo5sox4nqoAoGCCqGSM49
+AwEHoUQDQgAEMvzQzOxkTicM6ftl2HSkBNz/BX330NeG2Fx587ElA7LbARPS/65L
+vGEdbdN+BBlz7hGFlrgcoV/aOqvEJ4d9RA==
+-----END EC PRIVATE KEY-----
diff --git a/dev/tls_cluster/certs/foo-server-nomad.pem b/dev/tls_cluster/certs/foo-server-nomad.pem
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIIClzCCAj6gAwIBAgIQYb/SI/sKDeU/3CI8iVpH8jAKBggqhkjOPQQDAjCBtzEL
+MAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MRowGAYDVQQJExExMDEgU2Vjb25kIFN0cmVldDEOMAwGA1UEERMFOTQxMDUxFzAV
+BgNVBAoTDkhhc2hpQ29ycCBJbmMuMT4wPAYDVQQDEzVOb21hZCBBZ2VudCBDQSA4
+MjYwOTE2Njc3MDc4NTM3Mjk1NTExNzUyOTk1NTA5OTg3OTg1NDAeFw0yMzAyMTMw
+OTQzNDVaFw0yNDAyMTMwOTQzNDVaMBsxGTAXBgNVBAMTEHNlcnZlci5mb28ubm9t
+YWQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQy/NDM7GROJwzp+2XYdKQE3P8F
+fffQ14bYXHnzsSUDstsBE9L/rku8YR1t034EGXPuEYWWuByhX9o6q8Qnh31Eo4HG
+MIHDMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
+AwIwDAYDVR0TAQH/BAIwADApBgNVHQ4EIgQgFcd02ktSGsqNvdEJ2m7R4mzDgTJK
+yMCq2fJRBx6pAWUwKwYDVR0jBCQwIoAgJt7MGCV1pkZLmLAvx5NOLsM2WvKnCIqt
+kk8W8u+Ug4EwLAYDVR0RBCUwI4IQc2VydmVyLmZvby5ub21hZIIJbG9jYWxob3N0
+hwR/AAABMAoGCCqGSM49BAMCA0cAMEQCIEish743/KD215Snx2+WyFO9b7+adQX5
+ETaIZZJKYtEFAiBdKWiXQM1AQlZeFaXGI7nl2mzJj9CDfZgMoonTh8X4Sg==
+-----END CERTIFICATE-----
diff --git a/dev/tls_cluster/certs/nomad-agent-ca-key.pem b/dev/tls_cluster/certs/nomad-agent-ca-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMDaWs6qeCgZixzgZQgPe7jFkGWS9JS/OFcQR8QrWHGToAoGCCqGSM49
+AwEHoUQDQgAEU0VTvS/+HVkskpOU5p9mnvApQu1xaCbb2g/RgYsEo8BQ8iuwxTr3
+KEubOMdI0EGidkD3tYjLJFA7NfGuDX9o1A==
+-----END EC PRIVATE KEY-----
diff --git a/dev/tls_cluster/certs/nomad-agent-ca.pem b/dev/tls_cluster/certs/nomad-agent-ca.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC6TCCAo+gAwIBAgIQPiXyYUDxdsUIRIhEC74prjAKBggqhkjOPQQDAjCBtzEL
+MAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
+MRowGAYDVQQJExExMDEgU2Vjb25kIFN0cmVldDEOMAwGA1UEERMFOTQxMDUxFzAV
+BgNVBAoTDkhhc2hpQ29ycCBJbmMuMT4wPAYDVQQDEzVOb21hZCBBZ2VudCBDQSA4
+MjYwOTE2Njc3MDc4NTM3Mjk1NTExNzUyOTk1NTA5OTg3OTg1NDAeFw0yMzAyMTMw
+OTM0NDhaFw0yODAyMTIwOTM0NDhaMIG3MQswCQYDVQQGEwJVUzELMAkGA1UECBMC
+Q0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xGjAYBgNVBAkTETEwMSBTZWNvbmQg
+U3RyZWV0MQ4wDAYDVQQREwU5NDEwNTEXMBUGA1UEChMOSGFzaGlDb3JwIEluYy4x
+PjA8BgNVBAMTNU5vbWFkIEFnZW50IENBIDgyNjA5MTY2NzcwNzg1MzcyOTU1MTE3
+NTI5OTU1MDk5ODc5ODU0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEU0VTvS/+
+HVkskpOU5p9mnvApQu1xaCbb2g/RgYsEo8BQ8iuwxTr3KEubOMdI0EGidkD3tYjL
+JFA7NfGuDX9o1KN7MHkwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8w
+KQYDVR0OBCIEICbezBgldaZGS5iwL8eTTi7DNlrypwiKrZJPFvLvlIOBMCsGA1Ud
+IwQkMCKAICbezBgldaZGS5iwL8eTTi7DNlrypwiKrZJPFvLvlIOBMAoGCCqGSM49
+BAMCA0gAMEUCIQC2Q31pY0Vl7BPfLFD0CpBuvUNKeoXBuPYvL7Xojp+iqgIgRybk
+FyeAfhz09794kclLuWW5LeB4hkc4JMTEp30aV0A=
+-----END CERTIFICATE-----
diff --git a/dev/tls_cluster/certs/nomad-ca-key.pem b/dev/tls_cluster/certs/nomad-ca-key.pem
diff --git a/dev/tls_cluster/certs/nomad-ca.csr b/dev/tls_cluster/certs/nomad-ca.csr
diff --git a/dev/tls_cluster/certs/nomad-ca.pem b/dev/tls_cluster/certs/nomad-ca.pem
diff --git a/dev/tls_cluster/certs/server-key.pem b/dev/tls_cluster/certs/server-key.pem
diff --git a/dev/tls_cluster/certs/server.csr b/dev/tls_cluster/certs/server.csr
diff --git a/dev/tls_cluster/certs/server.pem b/dev/tls_cluster/certs/server.pem
diff --git a/dev/tls_cluster/client1.hcl b/dev/tls_cluster/client1.hcl
@@ -25,9 +25,9 @@ tls {
   http = true
   rpc  = true
 
-  ca_file   = "certs/nomad-ca.pem"
-  cert_file = "certs/client.pem"
-  key_file  = "certs/client-key.pem"
+  ca_file   = "certs/nomad-agent-ca.pem"
+  cert_file = "certs/foo-client-nomad.pem"
+  key_file  = "certs/foo-client-nomad-key.pem"
 
   verify_server_hostname = true
   verify_https_client    = true

diff --git a/dev/tls_cluster/client2.hcl b/dev/tls_cluster/client2.hcl
@@ -25,9 +25,9 @@ tls {
   http = true
   rpc  = true
 
-  ca_file   = "certs/nomad-ca.pem"
-  cert_file = "certs/client.pem"
-  key_file  = "certs/client-key.pem"
+  ca_file   = "certs/nomad-agent-ca.pem"
+  cert_file = "certs/foo-client-nomad.pem"
+  key_file  = "certs/foo-client-nomad-key.pem"
 
   verify_server_hostname = true
   verify_https_client    = true

diff --git a/dev/tls_cluster/server.hcl b/dev/tls_cluster/server.hcl
@@ -18,9 +18,9 @@ tls {
   http = true
   rpc  = true
 
-  ca_file   = "certs/nomad-ca.pem"
-  cert_file = "certs/server.pem"
-  key_file  = "certs/server-key.pem"
+  ca_file   = "certs/nomad-agent-ca.pem"
+  cert_file = "certs/foo-server-nomad.pem"
+  key_file  = "certs/foo-server-nomad-key.pem"
 
   verify_server_hostname = true
   verify_https_client    = true