Chapter 2. Configuring TLS encryption on a CUPS server

Procedure

1. Edit the /etc/cups/cups-files.conf file, and add the following setting to disable the automatic creation of self-signed certificates:

   CreateSelfSignedCerts no

   Copy to Clipboard Toggle word wrap

2. Remove the self-signed certificate and private key:

   # rm /etc/cups/ssl/<hostname>.crt /etc/cups/ssl/<hostname>.key

   Copy to Clipboard Toggle word wrap

3. Optional: Display the FQDN of the server:

   # hostname -f
   server.example.com

   Copy to Clipboard Toggle word wrap

4. Store the private key and server certificate in the /etc/cups/ssl/ directory, for example:

   # mv /root/server.key /etc/cups/ssl/server.example.com.key
   # mv /root/server.crt /etc/cups/ssl/server.example.com.crt

   Copy to Clipboard Toggle word wrap
   Important

   CUPS requires that you name the private key <fqdn>.key and the server certificate file <fqdn>.crt. If you use an alias, you must name the files <alias>.key and <alias>.crt.

5. Set secure permissions on the private key that enable only the root user to read this file:

   # chown root:root /etc/cups/ssl/server.example.com.key
   # chmod 600 /etc/cups/ssl/server.example.com.key

   Copy to Clipboard Toggle word wrap

   Because certificates are part of the communication between a client and the server before they establish a secure connection, any client can retrieve the certificates without authentication. Therefore, you do not need to set strict permissions on the server certificate file.

6. Restore the SELinux context:

   # restorecon -Rv /etc/cups/ssl/

   Copy to Clipboard Toggle word wrap

7. Optional: Display the CN and SAN fields of the certificate:

   # openssl x509 -text -in /etc/cups/ssl/server.example.com.crt
   Certificate:
     Data:
       ...
       Subject: CN = server.example.com
       ...
       X509v3 extensions:
         ...
         X509v3 Subject Alternative Name:
           DNS:server.example.com
     ...

   Copy to Clipboard Toggle word wrap

8. If the CN or SAN fields in the server certificate contains an alias that is different from the server’s FQDN, add the ServerAlias parameter to the /etc/cups/cupsd.conf file:

   ServerAlias alternative_name.example.com

   Copy to Clipboard Toggle word wrap

   In this case, use the alternative name instead of the FQDN in the rest of the procedure.

9. By default, CUPS enforces encrypted connections only if a task requires authentication, for example when performing administrative tasks on the /admin page in the web interface.

   To enforce encryption for the entire CUPS server, add Encryption Required to all <Location> directives in the /etc/cups/cupsd.conf file, for example:

   <Location />
     ...
     Encryption Required
   </Location>

   Copy to Clipboard Toggle word wrap

10. Restart CUPS:

    # systemctl restart cups

    Copy to Clipboard Toggle word wrap

Verification

1. Use a browser, and access https://<hostname>:631/admin/. This requires that your browser trusts the CA certificate. If the connection succeeds, you configured TLS encryption in CUPS correctly.
2. If you configured that encryption is required for the entire server, access http://<hostname>:631/. CUPS returns an Upgrade Required error in this case.