Chapter 2. Migrating TLS-e to the RHOSO deployment

Procedure

1. To locate the CA certificate and key, list all the certificates inside your NSSDB:

   $IPA_SSH certutil -L -d /etc/pki/pki-tomcat/alias

   • The -L option lists all certificates.

   • The -d option specifies where the certificates are stored.

     The command produces an output similar to the following example:

     Certificate Nickname                                         Trust Attributes
                                                                  SSL,S/MIME,JAR/XPI
     
     caSigningCert cert-pki-ca                                    CTu,Cu,Cu
     ocspSigningCert cert-pki-ca                                  u,u,u
     Server-Cert cert-pki-ca                                      u,u,u
     subsystemCert cert-pki-ca                                    u,u,u
     auditSigningCert cert-pki-ca                                 u,u,Pu

2. Export the certificate and key from the /etc/pki/pki-tomcat/alias directory. The following example uses the caSigningCert cert-pki-ca certificate:

   $IPA_SSH pk12util -o /tmp/freeipa.p12 -n 'caSigningCert\ cert-pki-ca' -d /etc/pki/pki-tomcat/alias -k /etc/pki/pki-tomcat/alias/pwdfile.txt -w /etc/pki/pki-tomcat/alias/pwdfile.txt

   Note

   The command generates a P12 file with both the certificate and the key. The /etc/pki/pki-tomcat/alias/pwdfile.txt file contains the password that protects the key. You can use the password to both extract the key and generate the new file, /tmp/freeipa.p12. You can also choose another password. If you choose a different password for the new file, replace the parameter of the -w option, or use the -W option followed by the password, in clear text.

   With that file, you can also get the certificate and the key by using the openssl pkcs12 command.

3. Create the secret that contains the root CA:

   $ oc create secret generic rootca-internal

4. Import the certificate and the key from FreeIPA:

   $ oc patch secret rootca-internal -p="{\"data\":{\"ca.crt\": \"`$IPA_SSH openssl pkcs12 -in /tmp/freeipa.p12 -passin file:/etc/pki/pki-tomcat/alias/pwdfile.txt -nokeys | openssl x509 | base64 -w 0`\"}}"
   
   $ oc patch secret rootca-internal -p="{\"data\":{\"tls.crt\": \"`$IPA_SSH openssl pkcs12 -in /tmp/freeipa.p12 -passin file:/etc/pki/pki-tomcat/alias/pwdfile.txt -nokeys | openssl x509 | base64 -w 0`\"}}"
   
   $ oc patch secret rootca-internal -p="{\"data\":{\"tls.key\": \"`$IPA_SSH openssl pkcs12 -in /tmp/freeipa.p12 -passin file:/etc/pki/pki-tomcat/alias/pwdfile.txt -nocerts -noenc | openssl rsa | base64 -w 0`\"}}"

5. Create the cert-manager issuer and reference the secret:

   $ oc apply -f - <<EOF
   apiVersion: cert-manager.io/v1
   kind: Issuer
   metadata:
     name: rootca-internal
     labels:
       osp-rootca-issuer-public: ""
       osp-rootca-issuer-internal: ""
       osp-rootca-issuer-libvirt: ""
       osp-rootca-issuer-ovn: ""
   spec:
     ca:
       secretName: rootca-internal
   EOF

6. Delete the previously created p12 files:

   $IPA_SSH rm /tmp/freeipa.p12