1 .. This work is licensed under a Creative Commons Attribution 4.0 International License.
2 .. http://creativecommons.org/licenses/by/4.0
3 Certificates (From AAF)
4 =======================
5 DCAE service components will use common certifcates generated from AAF/test instance and made available during deployment of DCAE TLS init container.
7 DCAE has a generalized process of certificate distribution as documented here - https://docs.onap.org/en/latest/submodules/dcaegen2.git/docs/sections/tls_enablement.html
9 The updated certificates are located in https://git.onap.org/dcaegen2/deployments/tree/tls-init-container/tls
11 Certificates (Manual configuration of self-signed certifcates)
12 ==============================================================
14 Configuration of Certificates in test environment(For FTP over TLS):
16 DFC supports two protocols: FTPES and SFTP.
17 For FTPES, it is mutual authentication with certificates.
18 In our test environment, we use vsftpd to simulate xNF, and we generate self-signed
19 keys & certificates on both vsftpd server and DFC.
21 1. Generate key/certificate with openssl for DFC:
22 -------------------------------------------------
25 openssl genrsa -out dfc.key 2048
26 openssl req -new -out dfc.csr -key dfc.key
27 openssl x509 -req -days 365 -in dfc.csr -signkey dfc.key -out dfc.crt
29 2. Generate key & certificate with openssl for vsftpd:
30 ------------------------------------------------------
33 openssl genrsa -out ftp.key 2048
34 openssl req -new -out ftp.csr -key ftp.key
35 openssl x509 -req -days 365 -in ftp.csr -signkey ftp.key -out ftp.crt
37 3. Configure java keystore in DFC:
38 ----------------------------------
39 We have two keystore files, one for TrustManager, one for KeyManager.
43 1. First, convert your certificate in a DER format :
47 openssl x509 -outform der -in ftp.crt -out ftp.der
49 2. And after, import it in the keystore :
53 keytool -import -alias ftp -keystore ftp.jks -file ftp.der
57 1. First, create a jks keystore:
61 keytool -keystore dfc.jks -genkey -alias dfc
63 2. Second, import dfc.crt and dfc.key to dfc.jks. This is a bit troublesome.
65 1). Step one: Convert x509 Cert and Key to a pkcs12 file
69 openssl pkcs12 -export -in dfc.crt -inkey dfc.key -out dfc.p12 -name [some-alias]
71 Note: Make sure you put a password on the p12 file - otherwise you'll get a null reference exception when you try to import it.
73 Note 2: You might want to add the -chainoption to preserve the full certificate chain.
75 2). Step two: Convert the pkcs12 file to a java keystore:
79 keytool -importkeystore -deststorepass [changeit] -destkeypass [changeit] -destkeystore dfc.jks -srckeystore dfc.p12 -srcstoretype PKCS12 -srcstorepass [some-password] -alias [some-alias]
81 4. Update existing jks.b64 files
82 ---------------------------------
84 Copy the existing jks from the DFC container to a local environment.
88 docker cp <DFC container>:/opt/app/datafile/config/ftp.jks .
89 docker cp <DFC container>:/opt/app/datafile/config/dfc.jks .
93 openssl base64 -in ftp.jks -out ftp.jks.b64
94 openssl base64 -in dfc.jks -out dfc.jks.b64
101 Copy the new jks.64 files from local environment to the DFC container.
105 docker cp ftp.jks.b64 <DFC container>:/opt/app/datafile/config/
106 docker cp dfc.jks.b64 <DFC container>:/opt/app/datafile/config/
112 docker restart <DFC container>
116 update /etc/vsftpd/vsftpd.conf:
120 rsa_cert_file=/etc/ssl/private/ftp.crt
121 rsa_private_key_file=/etc/ssl/private/ftp.key
124 force_local_data_ssl=YES
125 force_local_logins_ssl=YES
136 ca_certs_file=/home/vsftpd/myuser/dfc.crt
138 6. Configure config/datafile_endpoints.json:
139 --------------------------------------------
140 Update the file accordingly:
142 .. code-block:: javascript
144 "ftpesConfiguration": {
145 "keyCert": "/config/dfc.jks",
146 "keyPassword": "[yourpassword]",
147 "trustedCA": "/config/ftp.jks",
148 "trustedCAPassword": "[yourpassword]"
152 ---------------------------------------------------------------------------
153 This has been tested with vsftpd and dfc, with self-signed certificates.
154 In real deployment, we should use ONAP-CA signed certificate for DFC, and vendor-CA signed certificate for xNF