0006_cicd_part02_certificate_authority

Overview

The project 0006_cicd_part02_certificate_authority aims to establish a secure and professional environment for services within a CI/CD stack by implementing a custom Certificate Authority (CA). The goal is to enable secure HTTPS communication for internal services, overcoming common issues related to untrusted certificates and enhancing security practices.

The Challenge: Securing Services

In modern web environments, using unencrypted HTTP poses significant security risks, leading to browser warnings that undermine user trust and hinder functionality. This project addresses the following key issues:

• "Not Secure" Warnings: Deploying services without HTTPS results in security warnings in browsers, impacting user experience and trust.
• Functional Limitations: Tools like curl fail when accessing services with self-signed certificates, leading to potential security risks from using insecure flags.
• Java Tool Challenges: Java-based applications, such as Jenkins and SonarQube, face SSL handshake failures with untrusted certificates, disrupting automated pipelines.

Solution: Building a Private Certificate Authority

To mitigate security risks, the project introduces a Public Key Infrastructure (PKI) approach through the establishment of a private CA. This involves:

1. Creating a Root CA: Establishing a self-signed Root Certificate Authority to issue secure certificates for internal services.
2. Issuing Service Certificates: Automating the issuance of service certificates that comply with modern security standards, including Subject Alternative Names (SAN).
3. Establishing Trust: Configuring various trust stores to recognize the custom CA, ensuring that services run without encountering SSL errors.

Key Components

• OpenSSL Configuration: Utilizing openssl for CA setup, which includes creating configuration files, managing keys, and developing databases to track issued certificates.
• Custom Scripts: Development of scripts to automate the creation of certificates and the directory structure necessary for managing the CA.

Implementation Steps

• Creating the CA: Initial setup involves generating the root CA's private key and certificate, followed by creating a structured directory for managing certificates.
• Issuing Service Certificates: A script enables easy generation of service certificates, ensuring each service is granted a unique and trusted identity.
• Trust Configuration: A final step includes modifying several trust stores on the host machine to include the newly created CA, ensuring all services and browsers accept the established authority.

Example Scripts

CA Creation Script

A basic script to create the CA directory and generate the Root CA certificate is as follows:

# CA creation script  
cd ~/cicd_stack/ca  
...  
openssl genrsa -out pki/private/ca.key 4096  
openssl req -new -x509 -key pki/private/ca.key -days 3650 -out pki/certs/ca.pem

Service Issuance Script

The script for issuing service certificates allows for streamlined automation:

#!/usr/bin/env bash
SERVICE_NAME=$1  
openssl req -new -key $KEY_FILE -out $CSR_FILE
openssl ca -in $CSR_FILE -out $CERT_FILE

Final Remarks

By adopting a private CA for an internal CI/CD stack, this project provides a comprehensive solution to the "Not Secure" issues faced by web applications. It enhances security practices, ensures smooth functioning of automated tools, and promotes user trust by enabling secure HTTPS communication.