<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<base href="x-msg://846/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
I'm reading through the <a href="https://wiki.openstack.org/wiki/Neutron/LBaaS/SSL">https://wiki.openstack.org/wiki/Neutron/LBaaS/SSL</a> docs as well as the <a href="https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7" style="font-family: Calibri, sans-serif; font-size: 11pt; color: purple; ">https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7</a>
<div>document that your referencing below and I think who ever wrote the documents may have misunder stood the Association between X509 certificates and Private and public Keys.</div>
<div>I think we should clean those up and unambiguously declare that.</div>
<div><br>
</div>
<div><font color="#0061ff">A certificate shall be defined as a PEM encoded X509 certificate.</font></div>
<div><font color="#0061ff">For example</font></div>
<div><font color="#0061ff"><br>
</font></div>
<div>
<div><font color="#e32400">Certificate:</font></div>
<div>
<div><font color="#e32400">-----BEGIN CERTIFICATE-----</font></div>
<div><span style="color: rgb(227, 36, 0); "> blah blah blah base64 stuff goes here</span></div>
<div><span style="color: rgb(227, 36, 0); ">-----END CERTIFICATE-----</span></div>
</div>
</div>
<div><font color="#e32400"><br>
</font></div>
<div>A private key shall be a PEM encoded private key that may or may not necessarily be an RSA key. For example it could be </div>
<div>a curve key but most likely it will be RSA</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><font color="#669c35">a public-key shall mean an actual Pem encoded public key and not the x509 certificate that contains it. example</font></div>
<div><font color="#669c35">-----BEGIN PUBLIC KEY-----</font></div>
<div><font color="#669c35"> bah blah blah base64 stuff goes here</font></div>
<div>
<div><span style="color: rgb(102, 156, 53); ">-----END PUBLIC KEY-----</span></div>
</div>
<div>
<div><br>
</div>
<div><font color="#0042aa">A Private key shall mean a PEM encoded private key. </font></div>
<div><font color="#0042aa">Example</font></div>
<div>
<div><font color="#0042aa">-----BEGIN RSA PRIVATE KEY-----</font></div>
<div><font color="#0042aa"> blah blah blah base64 goes here.</font></div>
<div><span style="color: rgb(0, 66, 170); ">-----END RSA PRIVATE KEY-----</span></div>
</div>
<div><br>
</div>
<div>Also the same key could be encoded as pkcs8</div>
<div><br>
</div>
<div>
<div><font color="#4f7a28">-----BEGIN PRIVATE KEY-----</font></div>
<div><font color="#4f7a28"> base64 stuff here</font></div>
<div><span style="color: rgb(79, 122, 40); ">-----END PRIVATE KEY-----</span></div>
</div>
<div><br>
</div>
<div>I would think that we should allow for PKCS8 so that users are not restricted to PKCS1 RSA keys via "BEGIN PRIVATE KEY". I'm ok with forcing the user to not use PKCS8 to send both</div>
<div>the certificate and key.</div>
<div><br>
</div>
<div><b>There seems to be confusion in the neutron-lbaas-ssl-i7 ether pad doc as well as the doc at URL</b> <a href="https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7" style="font-family: Calibri, sans-serif; font-size: 11pt; color: purple; ">https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7</a></div>
<div><b>The confusion being that the term public key and certificate are being used interchangeably.</b></div>
<div><br>
</div>
<div>For example in the wiki page?</div>
<div>under Resource change:</div>
<div>SSL certidficate(new) declares</div>
<div><b><br>
</b></div>
<div><b>certificate_chain : list of PEM-formatted public keys, not mandatory </b></div>
<div>This should be changed to </div>
<div><b>certificate_chain: list of PEM-formatted x509 certificates, not mandatory</b></div>
<div><br>
</div>
<div>Also in the CLI portion of the doc their are entries like</div>
<div>neutron ssl-certificate-create --public-key CERTIFICATE-FILE <--private-key PRIVATE-KEY-FILE> <--passphrase PASSPHRASE> <--cert-chain INTERMEDIATE-KEY-FILE-1, INTERMEDIATE-KEY-FILE-2> certificate name</div>
<div>The option --public-key should be changed to <b>--cert</b> since it specifies the X509. Also the names INTERMEDIATE-KEY-FILE-1 etc should be changed to INTERMEDIATE-CERT-FILE-1 since these are x509s and not certs.</div>
<div><br>
</div>
<div><br>
</div>
<div>The below line mass no sense to me.</div>
<div><b>neutron ssl-trusted-certificate-create --key PUBLIC-KEY-FILE key name</b></div>
<div><br>
</div>
<div>Are you truing to give the certificate a name? We also will never need to work with public keys in general as the public key can be extracted from the x509 or the private key file. </div>
<div>Or was the intent to use ssl-trusted-certificates to specify the private keys that the Loadbalancer will use when communicating with back end servers that are doing
<b>client auth?</b></div>
<div> </div>
<div>the rational portion of the doc is declaring that trusted certificates are for back end encryption but don't mention if this is for client auth either. Was the intent to use a specific key for the SSL session between the load balancer and the back end
server or was the intention to advertise the client vert to the backend server so the the back end server can authenticate with what ever CA it(the server) trusts.</div>
<div><br>
</div>
<div>in either case both the private key and the certificate or chain should be used in this configuration since the loadbalancer needs the private key during the SSL session. </div>
<div>the command should look something alone the lines of</div>
<div><b>neutron ssl-trusted-certificate-create --key PRIVATE_KEY_FILE --cert CERTIFICATE-file.</b></div>
<div><br>
</div>
<div><br>
</div>
<div> I would like to help out with this but I need to know the intent of the person that initially interchanged the terms key and certificate, and its much better to fix this sooner then later.</div>
<div><br>
</div>
<div><br>
</div>
<div>On May 15, 2014, at 10:58 PM, Samuel Bercovici <<a href="mailto:SamuelB@Radware.com">SamuelB@Radware.com</a>> wrote:</div>
<div>
<div><br>
</div>
<div>
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Hi Everyone,</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><a href="https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7" style="color: purple; text-decoration: underline; ">https://etherpad.openstack.org/p/neutron-lbaas-ssl-l7</a><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Feel free to modify and update, please make sure you use your name so we will know who have added the modification.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Regards,<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> -Sam.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div>
</div>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" style="color: purple; text-decoration: underline; ">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" style="color: purple; text-decoration: underline; ">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>