Add certutil http command #49827

tvernum · 2019-12-04T11:46:52Z

This adds a new "http" sub-command to the certutil CLI tool.

The http command generates certificates/CSRs for use on the http
interface of an elasticsearch node/cluster.
It is designed to be a guided tool that provides explanations and
sugestions for each of the configuration options. The generated zip
file output includes extensive "readme" documentation and sample
configuration files for core Elastic products.

This adds a new "http" sub-command to the certutil CLI tool. The http command generates certificates/CSRs for use on the http interface of an elasticsearch node/cluster. It is designed to be a guided tool that provides explanations and sugestions for each of the configuration options. The generated zip file output includes extensive "readme" documentation and sample configuration files for core Elastic products.

elasticmachine · 2019-12-04T11:46:55Z

Pinging @elastic/es-security (:Security/Network)

tvernum · 2019-12-04T11:47:50Z

This currently only supports elasticsearch/ and kibana/ output.
I will add beats, logstash & clients at a later date, but I wanted to get the core done first, and then tweak it.

jkakavas

Did a first round today, I want to look at this once more, from a user's perspective this time as in actually using the tool, and I'll put in additional comments. Impressive amount of user-friendliness here @tvernum :)

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

.../cli/src/main/resources/org/elasticsearch/xpack/security/cli/certutil-http/ca-readme-p12.txt

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

...rity/cli/src/test/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommandTests.java

azasypkin

Kibana related pieces look good to me and everything seems to be in order (apart from minor path related issue). I assume PKI auth between Kibana and Elasticsearch is out of scope of this PR. Is there anything specific you want us to look at @tvernum?

Impressive amount of user-friendliness here @tvernum :)

I want to second this, the guidance is super clear and helpful!

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

.../cli/src/main/resources/org/elasticsearch/xpack/security/cli/certutil-http/kibana-sample.yml

tvernum · 2019-12-20T10:42:39Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

+    }
+
+    static FileType guessFileType(Path path, Terminal terminal) {
+        // trust the extension for some file-types rather then inspecting the contents


Suggested change

// trust the extension for some file-types rather then inspecting the contents

// trust the extension for some file-types rather than inspecting the contents

tvernum · 2019-12-20T10:45:25Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

+                    return types.get(0);
+                default:
+                    if (types.contains(FileType.PEM_KEY)) {
+                        // A Key and something else. Could be a cert + key paired, but we don't support that


Suggested change

// A Key and something else. Could be a cert + key paired, but we don't support that

// A Key and something else. Could be a cert + key pair, but we don't support that

tvernum · 2019-12-23T06:56:10Z

I assume PKI auth between Kibana and Elasticsearch is out of scope of this PR.

It is. I'd like to include it down the track, but I suspect that most people who decide to implement mutual TLS have an existing tool set that they're comfortable with, so I'll be prioritising the config other component (beats, language clients, etc) first.

Is there anything specific you want us to look at @tvernum?

If the Kibana setup makes sense (except for my path problem) then the main feedback I'm after is any suggestions for improvements in the text (or other UI feedback such as changing the order of the questions, etc).
I'm sure the current choice words have a lot of my viewpoint built in to them (e.g. using Australian terminology/idioms, or technical blind spots from years of TLS-wrangling), so just telling me if something sounds weird/confusing to you is helpful.

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

jkakavas · 2020-01-09T12:55:46Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

+    private CertificateTool.CAInfo findExistingCA(Terminal terminal, Environment env) throws UserException {
+        printHeader("What is the path to your CA?", terminal);
+
+        terminal.println("Please enter the full pathname to the Certificate Authority that you wish to");


The path is ( can be ) relevant to the ES_PATH_CONF of the elasticsearch installation. I am not sure if this is worth pointing out but, if users don't enter a full path ( starting with /) the error message can be somewhat confusing.

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

jkakavas · 2020-01-09T13:16:56Z

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

+        printHeader("What password do you want for your private keys?", terminal);
+        char[] password;
+        if (csr) {
+            terminal.println("Your private keys will be stored as a PEM formatted file.");


Suggested change

terminal.println("Your private keys will be stored as a PEM formatted file.");

terminal.println("Your private key(s) will be stored as PEM formatted file(s).");

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java

tvernum · 2020-01-13T07:51:50Z

@jkakavas I've addressed most of your comments. If I missed any that you still think are important, let me know and we'll work out a solution.

jkakavas · 2020-01-13T12:47:57Z

@jkakavas I've addressed most of your comments. If I missed any that you still think are important, let me know and we'll work out a solution.

Thanks for the iterations Tim. I have no more blocking feedback, I'd be very happy to see this merged

jkakavas

LGTM

tvernum · 2020-01-13T13:01:53Z

Thanks @jkakavas
I'm going to merge this as is, and work on docs and packaging tests in a followup PR.

This adds a new "http" sub-command to the certutil CLI tool. The http command generates certificates/CSRs for use on the http interface of an elasticsearch node/cluster. It is designed to be a guided tool that provides explanations and sugestions for each of the configuration options. The generated zip file output includes extensive "readme" documentation and sample configuration files for core Elastic products. Backport of: elastic#49827

This adds a new "http" sub-command to the certutil CLI tool. The http command generates certificates/CSRs for use on the http interface of an elasticsearch node/cluster. It is designed to be a guided tool that provides explanations and sugestions for each of the configuration options. The generated zip file output includes extensive "readme" documentation and sample configuration files for core Elastic products. Backport of: #49827

This adds a new "http" sub-command to the certutil CLI tool. The http command generates certificates/CSRs for use on the http interface of an elasticsearch node/cluster. It is designed to be a guided tool that provides explanations and sugestions for each of the configuration options. The generated zip file output includes extensive "readme" documentation and sample configuration files for core Elastic products.

tvernum added >enhancement :Security/TLS SSL/TLS, Certificates v8.0.0 v7.6.0 labels Dec 4, 2019

tvernum requested review from kobelb and jkakavas December 4, 2019 11:46

jkakavas reviewed Dec 11, 2019

View reviewed changes

azasypkin reviewed Dec 19, 2019

View reviewed changes

.../security/cli/src/main/java/org/elasticsearch/xpack/security/cli/HttpCertificateCommand.java Outdated Show resolved Hide resolved

.../cli/src/main/resources/org/elasticsearch/xpack/security/cli/certutil-http/kibana-sample.yml Outdated Show resolved Hide resolved

tvernum commented Dec 20, 2019

View reviewed changes

jkakavas requested changes Jan 9, 2020

View reviewed changes

tvernum added 2 commits January 13, 2020 17:26

Merge branch 'master' into certutil-http

a8b0e91

Address feedback

bdbb787

tvernum requested a review from jkakavas January 13, 2020 07:50

Address feedback (missed one)

0527aa8

jkakavas approved these changes Jan 13, 2020

View reviewed changes

tvernum merged commit 39a5d75 into elastic:master Jan 13, 2020

tvernum added the backport pending label Jan 13, 2020

tvernum mentioned this pull request Jan 14, 2020

[Backport 7.x] Add certutil http command #50952

Merged

tvernum removed the backport pending label Jan 14, 2020

This was referenced Jan 17, 2020

[DOCS] Adds http to elasticsearch-certutil command reference #51188

Merged

[DOCS] Adds certutil http command to TLS setup steps #51241

Merged

This was referenced Feb 3, 2020

[meta] 7.6 release elastic/elasticsearch-net#4340

Closed

[meta] 7.6 release elastic/elasticsearch-net#4341

Closed

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add certutil http command #49827

Add certutil http command #49827

tvernum commented Dec 4, 2019

elasticmachine commented Dec 4, 2019

tvernum commented Dec 4, 2019

jkakavas left a comment

azasypkin left a comment

tvernum Dec 20, 2019

tvernum Dec 20, 2019

tvernum commented Dec 23, 2019

jkakavas Jan 9, 2020

jkakavas Jan 9, 2020

tvernum commented Jan 13, 2020

jkakavas commented Jan 13, 2020

jkakavas left a comment

tvernum commented Jan 13, 2020

	// trust the extension for some file-types rather then inspecting the contents
	// trust the extension for some file-types rather than inspecting the contents

	// A Key and something else. Could be a cert + key paired, but we don't support that
	// A Key and something else. Could be a cert + key pair, but we don't support that

	terminal.println("Your private keys will be stored as a PEM formatted file.");
	terminal.println("Your private key(s) will be stored as PEM formatted file(s).");

Add certutil http command #49827

Add certutil http command #49827

Conversation

tvernum commented Dec 4, 2019

elasticmachine commented Dec 4, 2019

tvernum commented Dec 4, 2019

jkakavas left a comment

Choose a reason for hiding this comment

azasypkin left a comment

Choose a reason for hiding this comment

tvernum Dec 20, 2019

Choose a reason for hiding this comment

tvernum Dec 20, 2019

Choose a reason for hiding this comment

tvernum commented Dec 23, 2019

jkakavas Jan 9, 2020

Choose a reason for hiding this comment

jkakavas Jan 9, 2020

Choose a reason for hiding this comment

tvernum commented Jan 13, 2020

jkakavas commented Jan 13, 2020

jkakavas left a comment

Choose a reason for hiding this comment

tvernum commented Jan 13, 2020