配置 Tacker API 的 HTTPS/mTLS¶

本文档介绍了如何在 Tacker API 上设置 HTTPS 和双向 TLS，也称为相互 TLS (mTLS)。在本指南中，$tacker_host_name 将用作 Tacker API 的主机名。

注意

本文档的内容已确认在使用 Tacker 2024.1 Caracal 时有效。

准备工作¶

为了启用 TLS，需要使用私有/公共证书颁发机构 (CA) 作为根证书来签署证书。虽然通常使用公共 CA 颁发的证书，但本指南介绍了如何创建私有 CA 来测试 HTTPS/mTLS 功能。

创建私有证书颁发机构 (CA)¶

如果用于 mTLS 的证书由公共 CA 颁发，请跳过步骤 1 和 2。

生成 RSA 私钥。
```
$ openssl genrsa -out root_a.key 4096
```

生成自签名证书。

$ openssl req -new -x509 -key root_a.key -out root_a.pem -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:Musashino
Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenstackORG
Organizational Unit Name (eg, section) []:DevDept
Common Name (e.g. server FQDN or YOUR name) []:root_a.openstack.host
Email Address []:

如果需要支持多个根证书，则应将这些根证书合并并配置在服务器上。例如，本指南使用先前创建的 root_a.pem，以及以相同方式创建的 root_b.pem。在创建 root_b.pem 时，将 CN 指定为 root_b.openstack.host。

在此步骤中，通过连接两个根证书来创建一个新的 multi_ca.pem。

$ cat root_a.pem >> multi_ca.pem
$ cat root_b.pem >> multi_ca.pem
$ cat multi_ca.pem
-----BEGIN CERTIFICATE-----
MIIF1TCCA72gAwIBAgIUBAofPmi3cxX3/xvz6n3Pi9KjPW4wDQYJKoZIhvcNAQEL
BQAwejELMAkGA1UEBhMCSlAxDjAMBgNVBAgMBVRva3lvMRIwEAYDVQQHDAlNdXNh
...
HC1PfWQYli7d+98zz1KXwUkLv9MmBOOnP83wS4upfspTpU1wBK9ZcKFAS5MkpuS6
0x5atdhal1RlulNblqs6TR5W+uiffCJblQRzDMSLLZVzkAULhWqRRkS7PxtKnc2z
cidL67MTrzni
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIF1TCCA72gAwIBAgIUICVkJl1df1REQOKdF9VelC3+lEAwDQYJKoZIhvcNAQEL
BQAwejELMAkGA1UEBhMCSlAxDjAMBgNVBAgMBVRva3lvMRIwEAYDVQQHDAlNdXNh
...
g+kVxAXPwbrZKTsWMvsCvD0xXs3nC/FKmlPx5VL+6smAKPTWQr9M/k+4voviboms
V59KPLVlmxKE
-----END CERTIFICATE-----

创建私钥和证书¶

为了启用 TLS，需要创建私钥和证书。虽然通常使用公共 CA 颁发的证书，但本指南介绍了如何使用私有 CA 创建自签名证书来测试 mTLS 功能。如果用于 mTLS 的证书由公共 CA 颁发，请跳过这些步骤。

生成 RSA 私钥。

$ openssl genrsa -out tacker_api.key 4096

创建一个证书签名请求。

$ openssl req -new -key tacker_api.key -out tacker_api.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:Musashino
Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenstackORG
Organizational Unit Name (eg, section) []:DevDept
Common Name (e.g. server FQDN or YOUR name) []:$tacker_host_name
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

使用先前章节中创建的根证书对证书进行自签名。

$ openssl x509 -req -in tacker_api.csr \
-CA root_a.pem -CAkey root_a.key -CAcreateserial \
-out tacker_api.pem -days 365 -sha384
Certificate request self-signature ok
subject=C = JP, ST = Tokyo, L = Musashino, O = OpenstackORG, OU = DevDept, CN = $tacker_host_name

启用 HTTPS 指南¶

您可以按照以下步骤在 Tacker API 中配置 HTTPS。