Page History

...

• The SSL certificates should include the chain trust with them. They are added to the device as-is.
• For the netscaler loadbalancer, we assume that the port 22 is open and there is space in /nsconfig as we scp the certificate to the device.
• A loadbalancer rule can have only one certificate attached to it. A certificate however can be attached to multiple loadbalancers ( As long they are SSL type ). Support for multiple certificates for a single loadbalancer is not scoped.
• The certificate is not checked for validity at cloudstack level. The device errors if the certificate is invalid

Design

General Flow for assign/remove SSL certificate to a load balancer

• when calling AssignToLoadBalancerRule if there is a certificate id in the request execute() method of the command calls
  assignSslCertToLoadBalancer(lb_id, certId) in LoadBalancingRulesManagerImpl
• assignSslCertToLoadBalancer checks if the loadbalancer is capable of SSL. If not error is returned.
• verify if other certificate is bound to the loadbalancer and if it is, return error
• It then verifies if the certificate is valid ( not revoked ) and creates an entry in the load_balancer_cert_map table
• the loadbalncer state is set to Add
• call the applyLoadBalancerConfig which calls applyLoadBalancerRules with the lbId
• getLoadBalancerRuleToApply function should also add getSslCertificates(lbId) which gets called from applyLoadBalancerConfig
• Now the rule has SSL certificate info as well.
• When the rules get applied by calling applyLBRules of the NetscalerElement, the SSL info is passed inside the rule.
• Netscaler should check for SslOffload Capability if the rule has certificate info.
• NetscalerElement creates a LoadBalancerTO which transfers the params to the resouce layer.
• The LoadBalancerTO should contain SslCertTO for holding certificate information.

New classes and fields

• The SSL offload will be defined as a new Capability as SslOffload in Network.java static class Capability
• NetscalerElement when checking for canHandleLbRules will check for SSL rule and respond accordingly
• LoadBalancingRule will have a new static class LbSslCert and will have a list List<LbSslCert> for holding the certificate(s)
• LoadBalancerTO will have a new parameter for passing certificate information and an array SslCertsTO[] for holding the certificates.

// rule for SSL certificates
public class LoadBalancingRule { 
 ....

  public static class LbSslCert()
  {
    String cert;
    String key;
    String password;
    boolean _revoke;

    public LbSslCert(cert,key,password) {}
  
  }

  public void setSslCerts(List<SslCert> certs){}
  public void getSslCerts(List<SslCert> certs){}
...
}

The transfer object should also be able to pass SSL certs

...