diff --git a/docs/Setup/TLSSetup.md b/docs/Setup/TLSSetup.md new file mode 100644 index 00000000000..abc6b03497d --- /dev/null +++ b/docs/Setup/TLSSetup.md @@ -0,0 +1,66 @@ +### Steps to enable TLS for all sever (ECA , ACA , TLSCA , TCA) and between ACA client to server communications. + +1. Go to **memebersrvc.yaml** file under the fabric/membersrvc directory and edit security section, that is: +``` + security: + serverhostoverride: + tls_enabled: false + client: + cert: + file: +``` +To enable TLS between the ACA client and the rest of the CA Services set the `tls_enbabled` flag to `true`. + +2. Next, set **serverhostoverride** field to match **CN** (Common Name) of TLS Server certificate. To extract the Common Name from TLS Server's certificate, for example using OpenSSL, you can use the following command: + +``` +openssl x509 -in < 0) && (diffFromStart > 0)) + +} + +// NewClientTLSFromFile creates Client TLS connection credentials +// @certFile : TLS Server Certificate in PEM format +// @serverNameOverride : Common Name (CN) of the TLS Server Certificate +// returns Secure Transport Credentials +// +func NewClientTLSFromFile(certFile, serverNameOverride string) (credentials.TransportCredentials, error) { + caLogger.Debug("upgrading to TLS1.2") + b, err := ioutil.ReadFile(certFile) + + if err != nil { + caLogger.Errorf("Certificate could not be found in the [%s] path", certFile) + return nil, err + } + + if !isValidCertFormatted(certFile) { + return nil, nil + } + + cp := x509.NewCertPool() + + ok := cp.AppendCertsFromPEM(b) + if !ok { + caLogger.Error("credentials: failed to append certificates: ") + return nil, nil + } + return credentials.NewTLS(&tls.Config{ServerName: serverNameOverride, RootCAs: cp, MinVersion: 0, MaxVersion: 0}), nil +} + //GetClientConn returns a connection to the server located on *address*. func GetClientConn(address string, serverName string) (*grpc.ClientConn, error) { + + caLogger.Debug("GetACAClient: using the given gRPC client connection to return a new ACA client") var opts []grpc.DialOption - opts = append(opts, grpc.WithInsecure()) + + if viper.GetBool("security.tls_enabled") { + caLogger.Debug("TLS was enabled [security.tls_enabled == true]") + + creds, err := NewClientTLSFromFile(viper.GetString("security.client.cert.file"), viper.GetString("security.serverhostoverride")) + + if err != nil { + caLogger.Error("Could not establish TLS client connection in GetClientConn while getting creds:") + caLogger.Error(err) + return nil, err + } + opts = append(opts, grpc.WithTransportCredentials(creds)) + } else { + caLogger.Debug("TLS was not enabled [security.tls_enabled == false]") + opts = append(opts, grpc.WithInsecure()) + } opts = append(opts, grpc.WithTimeout(time.Second*3)) return grpc.Dial(address, opts...) } //GetACAClient returns a client to Attribute Certificate Authority. func GetACAClient() (*grpc.ClientConn, pb.ACAPClient, error) { + caLogger.Debug("GetACAClient: Trying to create a new ACA Client from the connection provided") conn, err := GetClientConn(viper.GetString("aca.address"), viper.GetString("aca.server-name")) if err != nil { return nil, nil, err diff --git a/membersrvc/membersrvc.yaml b/membersrvc/membersrvc.yaml index a3f8f39563a..84ef66d74d9 100644 --- a/membersrvc/membersrvc.yaml +++ b/membersrvc/membersrvc.yaml @@ -21,14 +21,26 @@ server: file: security: - # Can be 256 or 384 - # Must be the same as in core.yaml + # Either 256 or 384 (note: must be the exact same value as specified in the core.yaml file) level: 256 - # Can be SHA2 or SHA3 - # Must be the same as in core.yaml + # Either SHA2 or SHA3 (note: must be the exact same value as specified in the core.yaml file) hashAlgorithm: SHA3 + # The server host CN (Common Name) to be used (needs to match the TLS Server Certificate) + serverhostoverride: + + # Boolean (true/false) value indicating whether TLS should be used between the client and + # the various CA services (ECA, TCA, TLSCA, ACA) + tls_enabled: false + + # A PEM-encoded (X509 v3, Base64) certificate to use for establishing the TLS connection + # between the client and the ACA service + client: + cert: + file: + + # Enabling/disabling different logging levels of the CA. # logging: diff --git a/membersrvc/server.go b/membersrvc/server.go index 763d90f4c8a..bdc7fc11736 100644 --- a/membersrvc/server.go +++ b/membersrvc/server.go @@ -85,16 +85,22 @@ func main() { runtime.GOMAXPROCS(viper.GetInt("server.gomaxprocs")) var opts []grpc.ServerOption - if viper.GetString("server.tls.cert.file") != "" { + + if viper.GetBool("security.tls_enabled") { + logger.Debug("TLS was enabled [security.tls_enabled == true]") creds, err := credentials.NewServerTLSFromFile(viper.GetString("server.tls.cert.file"), viper.GetString("server.tls.key.file")) if err != nil { logger.Panic(err) } opts = []grpc.ServerOption{grpc.Creds(creds)} + } else { + logger.Debug("TLS was not enabled [security.tls_enabled == false]") } + srv := grpc.NewServer(opts...) if viper.GetBool("aca.enabled") { + logger.Debug("ACA was enabled [aca.enabled == true]") aca.Start(srv) } eca.Start(srv) diff --git a/mkdocs.yml b/mkdocs.yml index 73b7f9e0ff3..e98593a5668 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -19,6 +19,7 @@ pages: - Fabric Network Setup: Setup/Network-setup.md - NodeSDK Setup: Setup/NodeSDK-setup.md - CA Setup: Setup/ca-setup.md + - TLS Setup: Setup/TLSSetup.md - Logging: Setup/logging-control.md - APIs: