Chapter 2. Configuring TLS encryption on a CUPS server

Procedure

1. Edit the /etc/cups/cups-files.conf file, and add the following setting to disable the automatic creation of self-signed certificates:

   CreateSelfSignedCerts no

2. Remove the self-signed certificate and private key:

   # rm /etc/cups/ssl/<hostname>.crt /etc/cups/ssl/<hostname>.key

3. Optional: Display the FQDN of the server:

   # hostname -f
   server.example.com

4. Optional: Display the CN and SAN fields of the certificate:

   # openssl x509 -text -in /etc/cups/ssl/server.example.com.crt
   Certificate:
     Data:
       ...
       Subject: CN = server.example.com
       ...
       X509v3 extensions:
         ...
         X509v3 Subject Alternative Name:
           DNS:server.example.com
     ...

5. If the CN or SAN fields in the server certificate contains an alias that is different from the server’s FQDN, add the ServerAlias parameter to the /etc/cups/cupsd.conf file:

   ServerAlias alternative_name.example.com

   In this case, use the alternative name instead of the FQDN in the rest of the procedure.

6. Store the private key and server certificate in the /etc/cups/ssl/ directory, for example:

   # mv /root/server.key /etc/cups/ssl/server.example.com.key
   # mv /root/server.crt /etc/cups/ssl/server.example.com.crt

   Important

   CUPS requires that you name the private key <fqdn>.key and the server certificate file <fqdn>.crt. If you use an alias, you must name the files <alias>.key and <alias>.crt.

7. Set secure permissions on the private key that enable only the root user to read this file:

   # chown root:root /etc/cups/ssl/server.example.com.key
   # chmod 600 /etc/cups/ssl/server.example.com.key

   Because certificates are part of the communication between a client and the server before they establish a secure connection, any client can retrieve the certificates without authentication. Therefore, you do not need to set strict permissions on the server certificate file.

8. Restore the SELinux context:

   # restorecon -Rv /etc/cups/ssl/

9. By default, CUPS enforces encrypted connections only if a task requires authentication, for example when performing administrative tasks on the /admin page in the web interface.

   To enforce encryption for the entire CUPS server, add Encryption Required to all <Location> directives in the /etc/cups/cupsd.conf file, for example:

   <Location />
     ...
     Encryption Required
   </Location>

10. Restart CUPS:

    # systemctl restart cups

Verification

1. Use a browser, and access https://<hostname>:631/admin/. If the connection succeeds, you configured TLS encryption in CUPS correctly.
2. If you configured that encryption is required for the entire server, access http://<hostname>:631/. CUPS returns an Upgrade Required error in this case.