Setup Che in TLS mode with self-signed certificate

This guide is for development only. Self-signed certificates should not be used in production.

The following section describes deployment and configuration of Eclipse Che for using in TLS mode with self-signed certificates. It consists of following steps:

Generate needed keys and certificates if needed
Setup target deployment environment (minikube / minishift / crc)
Setup browser

Deploy Che with self signed TLS certificates on OpenShift 4 using operator

This section describes how to deploy Che with self-signed TLS certificates on OpenShift 4 container platform. We need to grab certificate generated by OpenShift and use it for Che and import it into browser.

Procedure

Get OpenShift 4 self-signed certificate

$ oc get secret router-ca -n openshift-ingress-operator -o jsonpath="{.data.tls\.crt}" | base64 -d > ca.crt

Pre-create namespace for Che
```
$ oc create namespace che
```

Create secret from CA certificate

$ oc create secret generic self-signed-certificate --from-file=ca.crt -n=che

Deploy Che using chectl

$ chectl server:start --platform=crc --installer=operator --tls --self-signed-cert

Deploy Che with self signed TLS certificates on Kubernetes

This section describes how to deploy Che with self-signed TLS certificates on Kubernetes platform.

Prerequisites

A running Kubernetes instance, version 1.9 or higher
Have all required keys/certificates generated

Procedure

Pre-create namespace for Che
```
$ kubectl create namespace che
```

Create secret with domain key and certificate

$ kubectl create secret tls che-tls --key=domain.key --cert=domain.crt -n che

Create secret from CA certificate

$ cp rootCA.crt ca.crt
$ kubectl create secret generic self-signed-certificate --from-file=ca.crt -n che

Deploy Che using chectl

$ chectl server:start --platform=minikube --installer=helm --tls --self-signed-cert

Deploy Che with self signed TLS certificates on OpenShift using operator

This section describes how to deploy Che with self-signed TLS certificates on OpenShift platform.

Prerequisites

A running OpenShift instance, version 3.11 or higher
Have all required keys/certificates generated

Procedure

$ oc login -u system:admin --insecure-skip-tls-verify=true
$ oc project default

Re-configure router with generated certificate

$ oc delete secret router-certs
$ cat domain.crt domain.key > minishift.crt
$ oc create secret tls router-certs --key=domain.key --cert=minishift.crt
$ oc rollout latest router

Pre-create namespace for Che
```
$ oc create namespace che
```

Create secret from CA certificate

$ cp rootCA.crt ca.crt
$ oc create secret generic self-signed-certificate --from-file=ca.crt -n=che

Deploy Che using chectl

$ chectl server:start --platform=minishift --installer=operator --tls --self-signed-cert

Generating self-signed TLS certificates

This section describes how to prepare self-signed TLS certificates to use with Che on different platforms.

Prerequisites

Find out expected domain name where Che deployment is planned

# default for minishift
$( minishift ip ).nip.io

# default for minikube
$( minikube ip ).nip.io

# default for crc
apps-crc.testing

Find out openssl.cnf file location on target machine
```
# Fedora 31
/etc/pki/tls/openssl.cnf
```

Procedure

Set necessary environment variables

$ CA_CN=eclipse-che-signer
$ DOMAIN=*.<expected.domain.com>
$ OPENSSL_CNF=<path_to_openssl.cnf>

# Example with minikube on Fedora 31
$ CA_CN=eclipse-che-signer
$ DOMAIN=*.$( minikube ip ).nip.io
$ OPENSSL_CNF=/etc/pki/tls/openssl.cnf

# Example with crc on OSX
$ export CA_CN=eclipse-che-signer
$ export DOMAIN=*.apps-crc.testing
$ export OPENSSL_CNF=/System/Library/OpenSSL/openssl.cnf

Generate root CA key. Add -des3 parameter if passphrase is needed
```
$ openssl genrsa -out rootCA.key 4096
```

Generate root certificate.

$ openssl req -x509 \
  -new -nodes \
  -key rootCA.key \
  -sha256 \
  -days 1024 \
  -out rootCA.crt \
  -subj /CN=${CA_CN} \
  -reqexts SAN \
  -extensions SAN \
  -config <(cat ${OPENSSL_CNF} \
      <(printf '[SAN]\nbasicConstraints=critical, CA:TRUE\nkeyUsage=keyCertSign, cRLSign, digitalSignature, keyEncipherment'))

Generate domain key.
```
$ openssl genrsa -out domain.key 2048
```

Generate domain csr.

$ openssl req -new -sha256 \
    -key domain.key \
    -subj "/O=EclipseChe/CN=${DOMAIN}" \
    -reqexts SAN \
    -config <(cat ${OPENSSL_CNF} \
        <(printf "\n[SAN]\nsubjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=keyCertSign, digitalSignature, keyEncipherment\nextendedKeyUsage=serverAuth")) \
    -out domain.csr

Generate domain certificate.

$ openssl x509 \
-req \
-sha256 \
-extfile <(printf "subjectAltName=DNS:${DOMAIN}\nbasicConstraints=critical, CA:FALSE\nkeyUsage=keyCertSign,                       digitalSignature, keyEncipherment\nextendedKeyUsage=serverAuth") \
-days 365 \
-in domain.csr \
-CA rootCA.crt \
-CAkey rootCA.key \
-CAcreateserial -out domain.crt

After executing those steps, it will be possible to use domain.crt and domain.key for Route/Ingress TLS and rootCA.crt for importing into browsers.

Che usage with TLS

This section describes how to import root certificate authority into the browser to use Che with self signed TLS.

Google Chrome

Go to chrome://settings/certificates, Authorities tab, click import and find your generated rootCA.crt (or ca.crt for OpenShift 4) file.
Select Trust this certificate for identifying websites and click OK.
Browser is satisfied with Che certificate and is reporting secure connection.

Firefox

Go to about:preferences and search for certificates and click View Certificates
Go to Authorities tab, click Import and find your generated rootCA.crt (or ca.crt for OpenShift 4) file.
Select Trust this CA to identify websites and click OK.
Browser is satisfied with Che certificate and is reporting secure connection.

OSX

Open Keychain Access.
Make sure you’re on System keychain and drop your rootCA.crt (or ca.crt for OpenShift 4) file there.
Double-click your imported CA, go to Trust and select When using this certificate: Always Trust.
If browser still report invalid certificate, try to restart it.

Tags: