https://pfspipe.ipmu.jp/jira This file is an XML representation of an issue en-us 8.3.4 803005 13-09-2019 https://pfspipe.ipmu.jp/jira/browse/INSTRM-235 Instrument control development <p>Add SAN to libvirt certs (and script to build them), to enable access both with IP address and hostname.<br/> This might require script to contact with DNS to get pair(s) of conversion.</p> INSTRM-235

Add SAN to libvirt certs

Task Normal Done Done shimono shimono Tue, 17 Oct 2017 13:46:18 +0000 Wed, 15 Nov 2017 12:07:58 +0000 Wed, 15 Nov 2017 12:07:58 +0000 ics_ansible 0 1 <p>tentative lines (not blushed, bare parameters), requires bash.</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"> openssl req -<span class="code-keyword">new</span> -newkey rsa:2048 -nodes -days 1825 -sha256 -out newcerts/10.100.200.146-2.csr -keyout <span class="code-keyword">private</span>/10.100.200.146-2.key -subj <span class="code-quote">"/C=JP/ST=Chiba/L=Kashiwa/O=PFS/CN=10.100.200.146"</span> -extensions SAN -config &lt;( cat ./virt-pki.cnf &lt;(printf <span class="code-quote">"[SAN]\nsubjectAltName=<span class="code-quote">'DNS:10.100.200.146,DNS:dlc2-vm,DNS:dlc2-vm.pfs.ipmu.jp'</span>"</span>)) -reqexts SAN openssl ca -config &lt;(cat ./virt-pki.cnf &lt;(printf <span class="code-quote">"[SAN]\nsubjectAltName=<span class="code-quote">'DNS:10.100.200.146,DNS:dlc2-vm,DNS:dlc2-vm.pfs.ipmu.jp'</span>"</span>)) -days 1825 -extensions SAN -policy policy_anything -out certs/10.100.200.146-2.pem -infiles newcerts/10.100.200.146-2.csr </pre> </div></div> <p>after building simple environment, add this to role/scripts made by <a href="https://pfspipe.ipmu.jp/jira/browse/INSTRM-210" title="Add role to build production private CA for virt" class="issue-link" data-issue-key="INSTRM-210"><del>INSTRM-210</del></a>.</p> <p>r? at PR.</p> <p>merged.</p> Relates INSTRM-210 Development Epic Link INSTRM-76 Rank 0|ii03dr: Reviewers yuki.moritani Sprint 2017-10A