Docs: External CA/PKI: clarify intermediate CA cross-signing options #10392
Conversation
Al2Klimov
added
area/distributed
doc/06-distributed-monitoring.md
Outdated
| ##### Using external intermediate CA as Icinga root CA | ||
|
|
||
| For Icinga to trust only its own CA, if the latter shall be an intermediate one, | ||
| do either of the following, depending on how strict your company policy is: | ||
|
|
||
| ###### Lax policy, Icinga itself issues leave certificates | ||
|
|
||
| 1. Setup Icinga as usual, with its own CA issueing leave certificates | ||
| 2. Cross-sign that CA with the desired parent CA, so that you get an intermediate CA | ||
| with the same subject and public key as the Icinga-own root CA | ||
| 3. Add that new intermediate CA to your trusted root CAs whereever possible and needed | ||
| to have an uninterrupted chain from your company CA to Icinga leave certificates | ||
|
|
||
| ###### Strict policy, Icinga doesn't issue leave certificates | ||
|
|
||
| 1. Create your intermediate CA for Icinga | ||
| 2. Cross-sign it with itself, so that you get two equal certificates, | ||
| except that one is self-signed | ||
| 3. Use the latter as Icinga root CA and deploy leave certificates manually, | ||
| each with the intermediate CA as described in the parent section |
There was a problem hiding this comment.
@mkayontour had some questions on this section. While answering, I thought of an option to suggest, but then realized it's not documented yet.😅 So before I explained it in 🇩🇪, I thought let's just write it down in 🇬🇧 here:
doc/06-distributed-monitoring.md
Outdated
| For Icinga to trust only its own CA, if the latter shall be an intermediate one, | ||
| do either of the following, depending on how strict your company policy is: |
There was a problem hiding this comment.
What should this paragraph say? Sorry for the blunt words, but I am confused reading this.
For Icinga to trust only its own CA, if the latter shall be an intermediate one,
Doesn't Icinga always has to trust its own CA? And isn't this whole chapter about intermediate CAs?
If I get the general gist right, how about something like:
In order to use an intermediate CA with Icinga, you can do one of the following, depending on the policies you have in place.
There was a problem hiding this comment.
If you have Root -> Int1 -> Leaf, in a sane setup, you'd probably just use Root as Icinga Root CA. But then Icinga trusts Intn. Some people want Icinga to trust only Int1, e.g #7719 (comment). But, as already in our docs, OpenSSL doesn't support an intermediate CA as root one, so you have to cross-sign.
But you can do latter in two directions, this is what I'm clarifying here.
doc/06-distributed-monitoring.md
Outdated
| For Icinga to trust only its own CA, if the latter shall be an intermediate one, | ||
| do either of the following, depending on how strict your company policy is: | ||
|
|
||
| ###### Lax policy, Icinga itself issues leave certificates |
There was a problem hiding this comment.
Why is this policy lax and the other strict? This has some implications, potentially leading people to irrational decisions. I would suggest dropping the rating.
| ###### Lax policy, Icinga itself issues leave certificates | |
| ###### Leaf certificates issued by Icinga |
doc/06-distributed-monitoring.md
Outdated
|
|
||
| ###### Lax policy, Icinga itself issues leave certificates | ||
|
|
||
| 1. Setup Icinga as usual, with its own CA issueing leave certificates |
There was a problem hiding this comment.
| 1. Setup Icinga as usual, with its own CA issueing leave certificates | |
| 1. Setup Icinga as usual, with its own CA issuing leaf certificates. |
doc/06-distributed-monitoring.md
Outdated
| 2. Cross-sign that CA with the desired parent CA, so that you get an intermediate CA | ||
| with the same subject and public key as the Icinga-own root CA |
There was a problem hiding this comment.
| 2. Cross-sign that CA with the desired parent CA, so that you get an intermediate CA | |
| with the same subject and public key as the Icinga-own root CA | |
| 2. Cross-sign this CA with the desired parent CA to create an intermediate CA. |
doc/06-distributed-monitoring.md
Outdated
| 3. Add that new intermediate CA to your trusted root CAs whereever possible and needed | ||
| to have an uninterrupted chain from your company CA to Icinga leave certificates |
There was a problem hiding this comment.
| 3. Add that new intermediate CA to your trusted root CAs whereever possible and needed | |
| to have an uninterrupted chain from your company CA to Icinga leave certificates | |
| 3. Add that new intermediate CA to your trusted root CAs where needed | |
| to have an uninterrupted chain from your main CA to Icinga leaf certificates. |
doc/06-distributed-monitoring.md
Outdated
| 3. Add that new intermediate CA to your trusted root CAs whereever possible and needed | ||
| to have an uninterrupted chain from your company CA to Icinga leave certificates | ||
|
|
||
| ###### Strict policy, Icinga doesn't issue leave certificates |
There was a problem hiding this comment.
| ###### Strict policy, Icinga doesn't issue leave certificates | |
| ###### Leaf certificates issued externally |
doc/06-distributed-monitoring.md
Outdated
| 1. Create your intermediate CA for Icinga | ||
| 2. Cross-sign it with itself, so that you get two equal certificates, | ||
| except that one is self-signed | ||
| 3. Use the latter as Icinga root CA and deploy leave certificates manually, | ||
| each with the intermediate CA as described in the parent section |
There was a problem hiding this comment.
Please end each sentence with a period and change leave to leaf, as I have suggested above.
Furthermore, this route needs a bit more details, imo. First, how should the intermediate CA be created? Then, unless I am mistaken, how can a CA cross-sign itself? Isn't this self-signing? When referring to "the latter" in your third statement, do you mean the signed one? Please name it.
There was a problem hiding this comment.
I'll have a look.
First, how should the intermediate CA be created?
- We already decided in Doc: Distributed Monitoring: add section "External CA/PKI" #9825 not to train people to do this
There was a problem hiding this comment.
IMHO, this still has very high "draw the rest of the owl" energy.
|
ref/NC/842002 |
Al2Klimov
force-pushed
the
Al2Klimov-patch-8
branch
from
e4c5215 to
8846465
Compare
No description provided.