Merge pull request #790 from nadvornik/db_cert

Internal SANs for db and reportdb are no longer required

Author: nadvornik

mgradm/shared/podman/ssl.go

@@ -97,7 +97,7 @@ func prepareThirdPartyCertificates(
 		log.Info().Msg(L("Using provided 3rd party database certificates"))
 		if err := prepareThirdPartyCertificate(
 			&sslFlags.DB.CA, &sslFlags.DB.SSLPair, shared_podman.DBCASecret,
-			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret, fqdn, "db", "reportdb",
+			shared_podman.DBSSLCertSecret, shared_podman.DBSSLKeySecret, fqdn,
 		); err != nil {
 			errs = append(errs, err)
 		}
@@ -163,10 +163,7 @@ func PrepareSSLCertificates(image string, sslFlags *adm_utils.InstallSSLFlags, t
 	}
 
 	// Generate them all in order to have the same expiration date on both.
-	return utils.JoinErrors(
-		generateServerCertificate(image, sslFlags, tz, fqdn),
-		generateDatabaseCertificate(image, sslFlags, tz, fqdn),
-	)
+	return generateServerCertificate(image, sslFlags, tz, fqdn)
 }
 
 func validateCA(image string, sslFlags *adm_utils.InstallSSLFlags, tz string) error {
@@ -203,7 +200,6 @@ func reuseExistingCertificates(image string, fqdn string, isDatabaseCheck bool)
 		if isDatabaseCheck {
 			secretName = shared_podman.DBSSLCertSecret
 			caSecretName = shared_podman.DBCASecret
-			fqdns = append(fqdns, "db", "reportdb")
 			msg = L("Reusing the existing database certificate secrets")
 		}
 		reused = isFQDNMatchingCertificateSecret(secretName, caSecretName, fqdns...)
@@ -422,49 +418,21 @@ func generateServerCertificate(image string, sslFlags *adm_utils.InstallSSLFlags
 
 	log.Info().Msg(L("Server SSL certificate generated"))
 
-	// Create secret for the database key and certificate
-	return shared_podman.CreateTLSSecrets(
+	// Create secret for the server key and certificate
+	if err := shared_podman.CreateTLSSecrets(
 		shared_podman.CASecret, path.Join(tempDir, "ca.crt"),
 		shared_podman.SSLCertSecret, path.Join(tempDir, "server.crt"),
 		shared_podman.SSLKeySecret, path.Join(tempDir, "server.key"),
-	)
-}
-
-func generateDatabaseCertificate(image string, sslFlags *adm_utils.InstallSSLFlags, tz string, fqdn string) error {
-	log.Info().Msg(L("Generating the database certificate…"))
-	// Write the ordered cert and Root CA to temp files
-	tempDir, cleaner, err := utils.TempDir()
-	defer cleaner()
-	if err != nil {
+	); err != nil {
 		return err
 	}
 
-	env := map[string]string{
-		"CERT_O":       sslFlags.Org,
-		"CERT_OU":      sslFlags.OU,
-		"CERT_CITY":    sslFlags.City,
-		"CERT_STATE":   sslFlags.State,
-		"CERT_COUNTRY": sslFlags.Country,
-		"CERT_EMAIL":   sslFlags.Email,
-		"CERT_CNAMES":  strings.Join(append([]string{fqdn}, sslFlags.Cnames...), " "),
-		"CERT_PASS":    sslFlags.Password,
-	}
-	if err := runSSLContainer(sslSetupDatabaseScript, tempDir, image, tz, env); err != nil {
-		return utils.Error(err, L("Failed to generate database SSL certificate"))
-	}
-
-	log.Info().Msg(L("Database SSL certificate generated"))
-
 	// Create secret for the database key and certificate
-	if err := shared_podman.CreateTLSSecrets(
+	return shared_podman.CreateTLSSecrets(
 		shared_podman.DBCASecret, path.Join(tempDir, "ca.crt"),
-		shared_podman.DBSSLCertSecret, path.Join(tempDir, "reportdb.crt"),
-		shared_podman.DBSSLKeySecret, path.Join(tempDir, "reportdb.key"),
-	); err != nil {
-		return err
-	}
-
-	return nil
+		shared_podman.DBSSLCertSecret, path.Join(tempDir, "server.crt"),
+		shared_podman.DBSSLKeySecret, path.Join(tempDir, "server.key"),
+	)
 }
 
 const sslSetupServerScript = `
@@ -518,27 +486,6 @@ const sslSetupServerScript = `
 	cp "/root/ssl-build/$MACHINE_NAME/server.key" /ssl/server.key
 `
 
-// This is assuming CA cert is generated by server script.
-// If we in any point in the future allow mix of 3rd party server and self signed ca for database
-// this will need to be updated to include check for ca cert and build if needed.
-const sslSetupDatabaseScript = `
-	echo "Generating DB certificate..."
-	cert_args=""
-	for CERT_CNAME in $CERT_CNAMES; do
-		cert_args="$cert_args --set-cname $CERT_CNAME"
-	done
-
-	rhn-ssl-tool --gen-server --cert-expiration 3650 \
-		--dir /root/ssl-build --password "$CERT_PASS" \
-		--set-country "$CERT_COUNTRY" --set-state "$CERT_STATE" --set-city "$CERT_CITY" \
-	    --set-org "$CERT_O" --set-org-unit "$CERT_OU" \
-	    --cert-expiration 3650 --set-email "$CERT_EMAIL" \
-		--set-hostname reportdb --set-cname db $cert_args
-
-	cp /root/ssl-build/RHN-ORG-TRUSTED-SSL-CERT /ssl/ca.crt
-	cp /root/ssl-build/reportdb/server.crt /ssl/reportdb.crt
-	cp /root/ssl-build/reportdb/server.key /ssl/reportdb.key
-`
 const sslValidateCA = `
 	CA_KEY=/root/ssl-build/RHN-ORG-PRIVATE-SSL-KEY
 	CA_PASS_FILE=/ssl/ca_pass

uyuni-tools.changes.nadvorni.db_cert

@@ -0,0 +1,2 @@
+- Internal SANs for db and reportdb are no longer required
+- Generate the same certificate for server and reportdb