Euca 5.0 Enable SSL with Combined CLC and Cluster Controller?

Question

I have completed an automated ansible install and have most of the wrinkles worked out.

All of my services except Nodes are running on a single box on non-secure HTTP though I specified 443 in my inventory I see now that does not imply an HTTPS configuration. So I have non-secure API endpoints listening on 443.

Is there any way around the requirements of operating CLC and Cluster Controller on different hardware as described in the SSL howto: https://docs.eucalyptus.cloud/eucalyptus/5/admin_guide/managing_system/bps/configuring_ssl/

I've read that how-to and can only guess that installing certs on the CLC messes up the Cluster Controller keys but I don't fully grasp it. Am I wasting my time trying to find a workaround or can I keep these services on the same box and still achieve SSL?

Answer 1

When you deploy eucalyptus using the ansible playbook a script will be available:

# /usr/local/bin/eucalyptus-cloud-https-import --help
Usage:

    eucalyptus-cloud-https-import [--alias ALIAS] [--key FILE] [--certs FILE]

which can be used to import a key and certificate chain from PEM files.

Alternatively you can follow the manual steps from the documentation that you referenced.

It is fine to use HTTPS with all components on a single host, the documentation is out of date.

Eucalyptus will detect if an HTTP(S) connection is using TLS (SSL) and use the configured certificate when appropriate.

It is recommended to use the ansible playbook certbot / Let's Encrypt integration for the HTTPS certificate when possible.

When manually provisioning certificates, wildcards can be used (*.DOMAIN *.s3.DOMAIN) so that all services and S3 buckets are included. If a wildcard certificate is not possible then the certificate should include the service endpoint names if possible (autoscaling, bootstrap, cloudformation, ec2, elasticloadbalancing, iam, monitoring, properties, route53, s3, sqs, sts, swf)