[GitHub] [pulsar] stanbog created a discussion: Using both a self-signed and official CA signed in pulsar-broker

[GitBox <gi...@apache.org>]

GitHub user stanbog created a discussion: Using both a self-signed and official CA signed in pulsar-broker

Hello,

We have a pulsar cluster version 2.10.2-1.
We would like to enable both TLS client authentication and TLS traffic encryption according to this documentation:

https://pulsar.apache.org/docs/2.11.x/security-tls-authentication/ -> client authentication
https://pulsar.apache.org/docs/2.11.x/security-tls-transport/ -> TLS traffic encryption 

The problem here is the fact that for the client authentication we need to use a self-signed that we generate, so multiple client certificates can be created based on this.
And for the TLS traffic encryption we need to use an official CA signed server certificate (like GlobalSign).

According to the documentation, we altered the following properties in the `pulsar-broker.conf` file:

```
# enable authentication
authenticationEnabled=true
# set mTLS authentication provider
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls

# configure TLS for client to connect brokers
brokerClientTlsEnabled=true
brokerClientTrustCertsFilePath=/path/to/ca-self-signed.cert.pem
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
brokerClientAuthenticationParameters={"tlsCertFile":"/path/to/admin-self-signed.cert.pem","tlsKeyFile":"/path/to/admin-self-signed.key-pk8.pem"}

# configure TLS ports
brokerServicePortTls=6651
webServicePortTls=8081

# configure CA certificate
tlsTrustCertsFilePath=/path/to/global-sign-ca.cert.pem
# configure server certificate
tlsCertificateFilePath=/path/to/global-sign-broker.cert.pem
# configure server's private key
tlsKeyFilePath=/path/to/global-sign-broker.key-pk8.pem

# enable mTLS
tlsRequireTrustedClientCertOnConnect=true
tlsAllowInsecureConnection=false

# Tls cert refresh duration in seconds (set 0 to check on every new connection)
tlsCertRefreshCheckDurationSec=300
```

So according to the documentation if we use the following certificates as:

For client authentication (sef-signed):
```
brokerClientTrustCertsFilePath=/path/to/ca-self-signed.cert.pem
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
brokerClientAuthenticationParameters={"tlsCertFile":"/path/to/admin-self-signed.cert.pem","tlsKeyFile":"/path/to/admin-self-signed.key-pk8.pem"}
```

For TLS traffic encryption (GlobalSign):

```
# configure CA certificate
tlsTrustCertsFilePath=/path/to/global-sign-ca.cert.pem
# configure server certificate
tlsCertificateFilePath=/path/to/global-sign-broker.cert.pem
# configure server's private key
tlsKeyFilePath=/path/to/global-sign-broker.key-pk8.pem
```

This should normally work, however when we try to authenticate with a client via a client self-signed certificat, we get an SSL error.

The only way this work, is to also change the above parameters to:

```
# configure CA certificate
tlsTrustCertsFilePath=/path/to/ca-self-signed.cert.pem
# configure server certificate
tlsCertificateFilePath=/path/to/admin-self-signed.cert.pem
# configure server's private key
tlsKeyFilePath=/path/to/admin-self-signed.key-pk8.pem
```

However, this will disable the TLS traffic encryption using the GlobalSign, we also need to use the self-signed here.

Is there any way to use both CAs in the pulsar-broker config: Self-signed for client authentication and GlobalSign for TLS encryption?

Thank you.

GitHub link: https://github.com/apache/pulsar/discussions/20212

----
This is an automatically sent email for commits@pulsar.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@pulsar.apache.org

[GitHub] [pulsar] nodece added a comment to the discussion: Using both a self-signed and official CA signed in pulsar-broker

["nodece (via GitHub)" <gi...@apache.org>]

GitHub user nodece added a comment to the discussion: Using both a self-signed and official CA signed in pulsar-broker

It seems you need to combine the multiple certificates into a single certificate file, and multiple keys into a single key file, but the Pulsar doesn't support load the multiple certificates/keys.

I suggest you should new an issue to track this feature.

You are using the Pulsar 2.10.x, please read the Pulsar 2.10.x doc, not Pulsar 2.11.x doc.

GitHub link: https://github.com/apache/pulsar/discussions/20212#discussioncomment-6194827

----
This is an automatically sent email for commits@pulsar.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@pulsar.apache.org

[GitHub] [pulsar] nodece edited a comment on the discussion: Using both a self-signed and official CA signed in pulsar-broker

["nodece (via GitHub)" <gi...@apache.org>]

GitHub user nodece edited a comment on the discussion: Using both a self-signed and official CA signed in pulsar-broker

It seems you need to combine the multiple certificates into a single certificate file, and multiple keys into a single key file, but the Pulsar doesn't support load the multiple certificates/keys.

I suggest you should create an issue to track this feature.

You are using the Pulsar 2.10.x, please read the Pulsar 2.10.x doc, not Pulsar 2.11.x doc.

GitHub link: https://github.com/apache/pulsar/discussions/20212#discussioncomment-6194827

----
This is an automatically sent email for commits@pulsar.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@pulsar.apache.org

[GitHub] [pulsar] tisonkun added a comment to the discussion: Using both a self-signed and official CA signed in pulsar-broker

["tisonkun (via GitHub)" <gi...@apache.org>]

GitHub user tisonkun added a comment to the discussion: Using both a self-signed and official CA signed in pulsar-broker

cc @nodece @michaeljmarshall 

GitHub link: https://github.com/apache/pulsar/discussions/20212#discussioncomment-6192046

----
This is an automatically sent email for commits@pulsar.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@pulsar.apache.org