You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2019/01/08 17:54:27 UTC
[GitHub] JBevillC opened a new pull request #3193: CIAB: Update X509 cert
generation, add certs to TV, fix TR tomcat native.
JBevillC opened a new pull request #3193: CIAB: Update X509 cert generation, add certs to TV, fix TR tomcat native.
URL: https://github.com/apache/trafficcontrol/pull/3193
CIAB: Update X509 cert generation, add certs to TV, fix TR tomcat native.
#### What does this PR do?
* CIAB: Update X509 Certificate documentation
* CIAB: Fix Tomcat Native SSL support
* CIAB: Add demo1 SSL keys to trafficvault on startup
* CIAB: Generate x509 certificates with proper Subject/Authority Key Identifiers
* CIAB: Add X509 root/intermediate CA certs to java keystore
* CIAB: Update each container to install the X509 CA full chain file
* CIAB: Add Full Chain certificate file
* CIAB: Generate x509 certificates with proper certType, keyUsage, and extendedKeyUsage directives
Fixes #(issue_number)
#### Which TC components are affected by this PR?
- [X] Documentation
- [ ] Grove
- [ ] Traffic Analytics
- [ ] Traffic Monitor
- [ ] Traffic Ops
- [ ] Traffic Ops ORT
- [ ] Traffic Portal
- [ ] Traffic Router
- [ ] Traffic Stats
- [ ] Traffic Vault
- [X] Other __CDN-in-a-Box_______
#### What is the best way to verify this PR?
1. Rebuild all CIAB containers
```
# From infrastructure/cdn-in-a-box
docker-compose build
```
2. Remove all existing CIAB containers and shared volumes
```
# From infrastructure/cdn-in-a-box
docker-compose kill
docker-compose rm -fv
docker volume prune -f
```
3 Remove any existing CIAB X509 certificates from infrastructure/cdn-in-a-box/traffic_ops/ca
```
# From infrastructure/cdn-in-a-box
rm -rfv ./infrastructure/cdn-in-a-box/traffic_ops/ca
```
4. Start up CIAB
```
docker-compose up
```
6. Wait (3-4min) for CIAB to start by checking for availability of traffic router dns zone
```
# From infrastructure/cdn-in-a-box
t=0
while true
do
docker-compose exec trafficops host -t soa mycdn.ciab.test >/dev/null 2>&1
if (($? == 0)) ; then
echo "CDN-in-a-Box is available ($t seconds)"
break
else
echo "Waiting for CDN-in-a-Box to start ($t seconds)"
sleep 3
((t+=3))
fi
done
```
Expected output:
```
Waiting for CDN-in-a-Box to start (0 seconds)
Waiting for CDN-in-a-Box to start (3 seconds)
Waiting for CDN-in-a-Box to start (6 seconds)
Waiting for CDN-in-a-Box to start (9 seconds)
Waiting for CDN-in-a-Box to start (12 seconds)
Waiting for CDN-in-a-Box to start (15 seconds)
Waiting for CDN-in-a-Box to start (18 seconds)
Waiting for CDN-in-a-Box to start (21 seconds)
Waiting for CDN-in-a-Box to start (24 seconds)
Waiting for CDN-in-a-Box to start (27 seconds)
Waiting for CDN-in-a-Box to start (30 seconds)
Waiting for CDN-in-a-Box to start (33 seconds)
Waiting for CDN-in-a-Box to start (36 seconds)
Waiting for CDN-in-a-Box to start (39 seconds)
Waiting for CDN-in-a-Box to start (42 seconds)
Waiting for CDN-in-a-Box to start (45 seconds)
Waiting for CDN-in-a-Box to start (48 seconds)
Waiting for CDN-in-a-Box to start (51 seconds)
Waiting for CDN-in-a-Box to start (54 seconds)
Waiting for CDN-in-a-Box to start (57 seconds)
Waiting for CDN-in-a-Box to start (60 seconds)
Waiting for CDN-in-a-Box to start (63 seconds)
Waiting for CDN-in-a-Box to start (66 seconds)
Waiting for CDN-in-a-Box to start (69 seconds)
Waiting for CDN-in-a-Box to start (72 seconds)
Waiting for CDN-in-a-Box to start (75 seconds)
CDN-in-a-Box is available (78 seconds)
```
6. TEST 1 - Ping traffic router delivery service IP
```
# From infrastructure/cdn-in-a-box
docker-compose exec trafficops ping video.demo1.mycdn.ciab.test
```
Expected Output:
```
PING video.demo1.mycdn.ciab.test (172.16.239.60) 56(84) bytes of data.
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=1 ttl=64 time=0.058 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=2 ttl=64 time=0.080 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=3 ttl=64 time=0.083 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=4 ttl=64 time=0.080 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=5 ttl=64 time=0.084 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=6 ttl=64 time=0.081 ms
64 bytes from trafficrouter.infra.ciab.test (172.16.239.60): icmp_seq=7 ttl=64 time=0.082 ms
```
7. TEST 2 - Test SSL capability of traffic router for demo1 delivery service. Correct response should be a 302 to the edge cache.
```
# From infrastructure/cdn-in-a-box
docker-compose exec trafficops curl -o /dev/null -v video.demo1.mycdn.ciab.test
```
Expected Output:
```
* Connected to video.demo1.mycdn.ciab.test (fc01:9400:1000:8::60) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
* subject: CN=*.demo1.mycdn.ciab.test,O=CDN-in-a-Box,L=Denver,ST=Colorado,C=US
* start date: Jan 03 00:55:00 2019 GMT
* expire date: Jan 03 00:55:00 2020 GMT
* common name: *.demo1.mycdn.ciab.test
* issuer: E=no-reply@infra.ciab.test,CN=CDN-in-a-Box Intermediate CA,OU=CDN-in-a-Box,O=CDN-in-a-Box,L=Denver,ST=Colorado,C=US
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: video.demo1.mycdn.ciab.test
> Accept: */*
>
< HTTP/1.1 302 Found
< Location: https://edge.demo1.mycdn.ciab.test/
< Content-Length: 0
< Date: Tue, 08 Jan 2019 17:33:12 GMT
```
Note: edge cache container still needs SSL certificates to be installed by ORT. This functionality will be implemented in a future PR.
#### Check all that apply
- [ ] This PR includes tests
- [X] This PR includes documentation updates
- [ ] This PR includes an update to CHANGELOG.md
- [ ] This PR includes all required license headers
- [ ] This PR includes a database migration (ensure that migration sequence is correct)
- [ ] This PR fixes a serious security flaw. Read more: [www.apache.org/security](http://www.apache.org/security/)
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services