Add `mgradm` command to help rotating SSL CA and certificates

[cbosdo]

Rotating SSL CA and certificates can be a pain and may even be more complex with the DB split into another container. Implement a command to help users with this.

[aaannz]

I don't follow how it is more complex now.

podman secret create --replace $cert_name $cert_path (and same for the key) is all what is needed here.
And after that mgradm restart.

I documented it in uyuni-project/uyuni-docs@eec5bef

[cbosdo]

We probably need to wire this in with certificates generation in an mgradm command for people not using 3rd party certificates.

[mayrstefan]

@aaannz the docs show us how to replace the files. But it misses how to rotate the SSL CA if it was compromised or will expire.

[aaannz]

It specified that here:

podman secret create --replace uyuni-ca $path_to_ca_certificate
podman secret create --replace uyuni-db-ca $path_to_database_ca_certificate
podman secret create --replace uyuni-cert $path_to_server_certificate
podman secret create --replace uyuni-key $path_to_server_key
podman secret create --replace uyuni-db-cert $path_to_database_certificate
podman secret create --replace uyuni-db-key $path_to_database_key
mgradm restart

this rotates everything, including CA and then mentions also applying highstate.

What do you find missing?

[mayrstefan]

@aaannz the example just changes files. It does not create new certificates or a new ca.

So when a certificate or the ca expires is compromised: how to create new files? When we install Uyuni mgradm creates the necessary certificates when they do not exist. But there is no tooling for recreating those certificates or the ca

[mayrstefan]

I think of something like that:

uyuni-tools/mgradm/shared/podman/ssl.go

Lines 420 to 447 in 952fafe

	# Only generate a CA is we don't have it yet
	if ! test -e /root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT; then
	echo "Generating the self-signed SSL CA..."
	mkdir -p /root/ssl-build
	rhn-ssl-tool --gen-ca --force --dir /root/ssl-build \
	--password "$CERT_PASS" \
	--set-country "$CERT_COUNTRY" --set-state "$CERT_STATE" --set-city "$CERT_CITY" \
	--set-org "$CERT_O" --set-org-unit "$CERT_OU" \
	--set-common-name "$HOSTNAME" --cert-expiration 3650
	fi
	cp /root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT /ssl/ca.crt
	echo "Generate apache certificate..."
	cert_args=""
	for CERT_CNAME in $CERT_CNAMES; do
	cert_args="$cert_args --set-cname $CERT_CNAME"
	done
	rhn-ssl-tool --gen-server --cert-expiration 3650 \
	--dir /root/ssl-build --password "$CERT_PASS" \
	--set-country "$CERT_COUNTRY" --set-state "$CERT_STATE" --set-city "$CERT_CITY" \
	--set-org "$CERT_O" --set-org-unit "$CERT_OU" \
	--set-hostname "$HOSTNAME" --cert-expiration 3650 --set-email "$CERT_EMAIL" \
	$cert_args
	MACHINE_NAME=$(getMachineName "$HOSTNAME")
	cp "/root/ssl-build/$MACHINE_NAME/server.crt" /ssl/server.crt
	cp "/root/ssl-build/$MACHINE_NAME/server.key" /ssl/server.key

[aaannz]

Ah I see. I was thinking in a different context.

We have it documented here https://www.uyuni-project.org/uyuni-docs/en/uyuni/administration/ssl-certs-selfsigned.html

Linking between those parts can be for sure improved.