mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-11 16:51:55 -06:00
4cf9c8689f
BACKGROUND: We are implementing ACME support in FreeIPA (umbrella ticket: https://pagure.io/freeipa/issue/4751). ACME is defined in RFC 8555. HTTPS is REQUIRED (https://tools.ietf.org/html/rfc8555#section-6.1). Therefore, every FreeIPA server that provides the ACME service capability must be reachable by HTTPS. RFC 8555 does not say anything about which port to use for ACME. The default HTTPS port of 443 is implied. Therefore, the FreeIPA ACME service will be reached via the Apache httpd server, which will be the TLS server endpoint. As a usability affordance for ACME clients, and as a maintainability consideration i.e. to allow the topology to change without having to reconfigure ACME clients, there should be a a single DNS name used to reach the IPA ACME service. The question then, is which DNS name to use. REQUIREMENTS: Each FreeIPA server that is also an ACME server must: 1. Be reachable via a common DNS name 2. Have an HTTP service certificate with that DNS name as a SAN dNSName value DESIGN CONSIDERATION - WHAT DNS NAME TO USE?: Some unrelated FreeIPA ACME design decisions provide important context for the DNS name decision: - The ACME service will be automatically and unconditionally deployed (but not necessarily *enabled*) on all CA servers. - Enabling or disabling the ACME service will have topology-wide effect, i.e. the ACME service is either enabled on all CA servers, or disabled on all CA servers. In a CA-ful FreeIPA deployment there is already a DNS name that resolves to all CA servers: ``ipa-ca.$DOMAIN``, e.g. ``ipa-ca.example.com``. It is expected to point to all CA servers in the deployment, and *only* to CA servers. If internal DNS is deployed, the DNS records for ``ipa-ca.$DOMAIN`` are created and updated automatically. If internal DNS is not deployed, administrators are required to maintain these DNS records themselves. The ``ipa-ca.$DOMAIN`` alias is currently used for OCSP and CRL access. TLS is not required for these applications (and it can actually be problematic for OCSP). Enabling TLS for this name presents some risk of confusion for operators. For example, if they see that TLS is available and alter the certificate profiles to include an HTTPS OCSP URL in the Authority Information Access (AIA) extension, OCSP-using clients may fail to validate such certificates. But it is possible for administrators to make such a change to the profile, whether or not HTTPS is available. One big advantage to using the ``ipa-ca.$DOMAIN`` DNS name is that there are no new DNS records to manage, either in the FreeIPA implementation or for administrators in external DNS systems. The alternative approach is to define a new DNS name, e.g. ``ipa-acme.$DOMAIN``, that ACME clients would use. For internal DNS, this means the FreeIPA implementation must manage the DNS records. This is straightforward; whenever we add or remove an ``ipa-ca.$DOMAIN`` record, also add/remove the ``ipa-acme.$DOMAIN`` record. But for CA-ful deployments using external DNS, it is additional work for adminstrators and, unless automated, additional room for error. An advantage of using a different DNS name is ``ipa-ca.$DOMAIN`` can remain inaccessible over HTTPS. This possibly reduces the risk of administrator confusion or creation of invalid AIA configuration in certificate profiles. Weighing up the advantages and disadvantages, I decided to use the ``ipa-ca.$DOMAIN`` DNS name. DESIGN CONSIDERATION - CA SERVERS, OR ALL SERVERS?: A separate decision from which name to use is whether to include it on the HTTP service certificate for ACME servers (i.e. CA servers) only, or on all IPA servers. Combined with the assumption that the chosen DNS name points to CA servers *only*, there does not seem to be any harm in adding it to the certificates on all IPA servers. The alternative is to only include the chosen DNS name on the HTTP service certificates of CA servers. This approach entails some additional complexity: - If a non-CA replica gets promoted to CA replica (i.e. via ``ipa-ca-install``), its HTTP certificate must be re-issued with the relevant name. - ipa-server-upgrade code must consider whether the server is a CA replica when validating (and if necessary re-creating) Certmonger tracking requests - IPA Health Check must be made aware of this factor when checking certificates and Certmonger tracking requests. Weighing up the options, I decided to add the common DNS name to the HTTP service certificate on all IPA servers. This avoids the implementation complexity discussed above. CHANGES IN THIS COMMIT When (re-)tracking the HTTP certificate, explicitly add the server FQDN and ipa-ca.$DOMAIN DNS names to the Certmonger tracking request. Related changes follow in subsequent commits. Part of: https://pagure.io/freeipa/issue/8186 Reviewed-By: Rob Crittenden <rcritten@redhat.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| certmonger.py | ||
| certstore.py | ||
| hostname.py | ||
| kinit.py | ||
| service.py | ||
| sysrestore.py | ||