Chapter 4. Configuring quantum secure gateways

Procedure

1. Create a directory for your certificates by running the following command:

   $ mkdir certs

2. Generate the certificates for your gateway similar to the following examples:

   • Create the first certificate by running the following command:

     $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
       -subj '/O=example Inc./CN=example.com' \
       -keyout certs/example.com.key \
       -out certs/example.com.crt

   • Create the second certificate by running the following command:

     $ openssl req -out certs/httpbin.example.com.csr -newkey rsa:2048 -nodes \
       -keyout certs/httpbin.example.com.key \
       -subj "/CN=httpbin.example.com/O=httpbin organization"

   • Create the third certificate by running the following command:

     $ openssl x509 -req -sha256 -days 365 \
       -CA certs/example.com.crt -CAkey certs/example.com.key \
       -set_serial 0 -in certs/httpbin.example.com.csr \
       -out certs/httpbin.example.com.crt

3. Create a secret containing the TLS certificate for your gateway by running the following command:

   $ oc create -n istio-system secret tls httpbin-credential \
       --key=certs/httpbin.example.com.key \
       --cert=certs/httpbin.example.com.crt

Procedure

1. Deploy a gateway using the Kubernetes Gateway API by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1beta1
   kind: Gateway
   metadata:
    name: pqc-gateway
    namespace: istio-system
   spec:
    gatewayClassName: istio
    listeners:
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
        - name: httpbin-credential
          namespace: istio-system
      allowedRoutes:
        namespaces:
          from: All
   ---
   apiVersion: gateway.networking.k8s.io/v1beta1
   kind: HTTPRoute
   metadata:
    name: httpbin-route
    namespace: default
   spec:
    parentRefs:
    - name: pqc-gateway
      namespace: istio-system
    hostnames:
    - "httpbin.example.com"
    rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
      - name: httpbin
        port: 8000
   EOF

2. Add the istio-injection=enabled label to the default namespace by running the following command:

   $ oc label ns default istio-injection=enabled

3. Deploy the backend server by running the following command:

   $ oc apply -n default -f \
   https://raw.githubusercontent.com/openshift-service-mesh/istio/master/samples/httpbin/httpbin.yaml

Procedure

1. Retrieve the external address based on the type of load balancer:

   1. Retrieve the external address for your hostname-based load balancer by running the following command:

      $ INGRESS_ADDR=$(oc get svc pqc-gateway-istio \
      -n istio-system \
      -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

   2. Retrieve the external address for your IP-based load balancer by running the following command:

      $ INGRESS_ADDR=$(oc get svc pqc-gateway-istio \
      -n istio-system \
      -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

2. Test the connection with the PQC-enabled client by running the following command:

   $ podman run --rm -it \
     -v ./certs/example.com.crt:/etc/certs/example.com.crt \
     docker.io/openquantumsafe/curl \
     curl -vk "https://$INGRESS_ADDR:443/headers" \
     -H "Host: httpbin.example.com" \
     --curves X25519MLKEM768 \
     --cacert /etc/certs/example.com.crt

   The request should succeed, and you should receive the HTTP status as 200.

3. Verify that the connection fails with a standard curl client by running the following command:

   $ curl -vk "https://$INGRESS_ADDR:443/headers" \
     -H "Host: httpbin.example.com" \
     --cacert ./certs/example.com.crt

   You will get errors similar to the following example:

   * TLSv1.3 (OUT), TLS handshake, Client hello (1):
   * TLSv1.3 (IN), TLS alert, handshake failure (552):
   * TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
   * closing connection #0
   curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure