2.12. Configuring an NFS server with TLS support

Procedure

1. Create a private key and a certificate signing request (CSR):

   # openssl req -new -newkey rsa:4096 -noenc \
   -keyout /etc/pki/tls/private/server.example.com.key \
   -out /etc/pki/tls/private/server.example.com.csr \
   -subj "/C=US/ST=State/L=City/O=Organization/CN=server.example.com" \
   -addext "subjectAltName=DNS:server.example.com,IP:192.0.2.1"

   重要

   Common Name (CN) and DNS must match the hostname. IP must match IP of the host.

2. Send the /etc/pki/tls/private/server.example.com.csr file to a CA and request a server certificate. Store the received CA certificate and the server certificate on the host.

3. Import the CA certificate to the systems’s truststore:

   # cp ca.crt /etc/pki/ca-trust/source/anchors
   # update-ca-trust

4. Move the server certificate to the /etc/pki/tls/certs/ directory:

   # mv server.example.com.crt /etc/pki/tls/certs/

5. Ensure the SELinux context is correct on the private key and certificates:

   # restorecon -Rv /etc/pki/tls/certs/

6. Add the server certificate and private key to the [authenticate.server] section in the /etc/tlshd.conf file:

   x509.certificate= /etc/pki/tls/certs/server.example.com.crt
   x509.private_key= /etc/pki/tls/private/server.example.com.key

   Leave the x509.truststore parameter unset.

7. Enable and start the tlshd service:

   # systemctl enable --now tlshd.service