Date: Fri, 20 Mar 2020 22:03:12 +0100 From: Miroslav Lachman <000.fbsd@quip.cz> To: Rick Macklem <rmacklem@uoguelph.ca>, "freebsd-current@FreeBSD.org" <freebsd-current@FreeBSD.org> Subject: Re: TLS certificates for NFS-over-TLS floating client Message-ID: <5c77aeed-568f-b85c-286e-8b7f3207c952@quip.cz> In-Reply-To: <20200320192923.GK4213@funkthat.com> References: <YTBPR01MB3374EFF14948CB8FEA1B5CCDDDE50@YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM> <20200319191605.GJ4213@funkthat.com> <YTBPR01MB337407CFCBE26DBAB1BC985ADDF40@YTBPR01MB3374.CANPRD01.PROD.OUTLOOK.COM> <20200320192923.GK4213@funkthat.com>
next in thread | previous in thread | raw e-mail | index | archive | help
John-Mark Gurney wrote on 2020/03/20 20:29: > Rick Macklem wrote this message on Thu, Mar 19, 2020 at 23:41 +0000: [...] >>> Without a problem statement or what you're trying to accomplish, it's >>> hard to say if it is. >> The problem I was/am trying to solve was a way for NFS clients without a >> fixed IP/DNS name could have a certificate to allow access to the NFS server. >> As suggested by others, having a site local CA created by the NFS admin. seemed > > Yes, I totally agree w/ this as the best solution. It also allows > private hostnames to be used w/o leaking outside the org.. > > It'd be nice to have better tooling around the CA though. I still > haven't found any good tools that make a CA simple to use for small > installs... (and by simple, I mean single init command, and single > command to issue a cert or generate a key/cert pair, all of them are > like, make all thesse directories, edit these files, and run these > comlicated commands) security/easy-rsa is very close to this. # easyrsa init-pki # easyrsa build-ca # easyrsa build-server-full <your_server> # easyrsa build-client-full <client_name1> # easyrsa build-client-full <client_name2> # easyrsa build-client-full <client_nameN> or # easyrsa build-client-full <client_nameN> nopass And usually # easyrsa gen-dh With "build-ca" you will create key and certificate for you private CA With "build-server-full" you will create key and certificate for your server With "build-client-full" you will create key and certificate for clients It also supports "revoke" and "gen-crl" to revoke compromised certificate and update CRL. Yes, it could be made a bit simpler and run init-pki in the background if build-ca is run for the first time so you can save one step. I don't say easy-rsa is the best choice. I am able to use full openssl commands or write my own tools / scripts around it I choose easy-rsa on machines where somebody else needs to work with certs. [...] Kind regards Miroslav Lachman
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5c77aeed-568f-b85c-286e-8b7f3207c952>