Versions Compared

Old Version 81

changes.mady.by.user Syed Ahmed

Saved on

compared with

New Version Current

changes.mady.by.user Will Stevens

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 5.3

...

Version

Author

Date

Changes

V1.0

Syed Ahmed

07-Oct-2013

Initial Draft

V1.1

Syed Ahmed

08-Oct-2013

Changing name & updating uploadSSLCert to include certificate chain

V1.2Will Stevens22-Sep-2014Added support for Projects as well as allowing an admin to assign certs to one of their users accounts

Functional requirements & non-requirements

...

Architecture and Design description

...

Assumptions

  • The SSL certificates should include the chain trust with them. They are added to the device as-is. ( Cert chain will be passed as an optional argument )
  • For the netscaler loadbalancer, we assume that the port 22 is open and there is space in /nsconfig as we scp the certificate to the device.
  • A loadbalancer rule can have only one certificate attached to it. A certificate however can be attached to multiple loadbalancers ( As long they are SSL type ). Support for multiple certificates for a single loadbalancer is not scoped.
  • The certificate is not checked for validity at cloudstack level. The device errors if the certificate is invalid ( Certificate validation happens at cloudstack )

...

  • when calling AssignToLoadBalancerRule if there is a certificate id in the request execute() method of the command calls
    assignSslCertToLoadBalancer(lb_id, certId) in LoadBalancingRulesManagerImpl
  • assignSslCertToLoadBalancer checks if the loadbalancer is capable of SSL. If not error is returned.
  • verify if other certificate is bound to the loadbalancer and if it is, return error
  • It then verifies if the certificate is valid ( not revoked ) and creates an entry in the load_balancer_cert_map table
  • the loadbalncer loadbalancer state is set to Add
  • call the applyLoadBalancerConfig which calls applyLoadBalancerRules with the lbId
  • getLoadBalancerRuleToApply function should also add getSslCertificates(lbId) which gets called from applyLoadBalancerConfig
  • Now the rule has SSL certificate info as well.
  • When the rules get applied by calling applyLBRules of the NetscalerElement, the SSL info is passed inside the rule.
  • Netscaler should check for SslOffload Capability if the rule has certificate info.
  • NetscalerElement creates a LoadBalancerTO which transfers the params to the resouce resource layer.
  • The LoadBalancerTO should contain SslCertTO for holding certificate information.

...

Field name

Type

Allow nulls

Key

Default value

id

bigint(20) unsigned

No

Primary

Null

uuid

varchar(40)

Yes

Unique

Null

account_id

bigint(20)

No

Mul

Null

certificate

text

cert

varchar(255)

No

None

Null

chain

varchar(255)text

Yes

None

Null

key

varchar(255)text

No

None

Null

password

varchar(255)

Yes

None

Null

created

datatime

Yes

None

Null

domain_id

 bigint(20) unsigned

revoke

tinyint(1)

No

NoneMul

0Null


load_balancer_cert_map(id, load_balancer_id, certcertitficate_id, revoke, state)

Field name

Type

Allow nulls

Key

Default value

id

bigint(20) unsigned

No

Primary

Null

uuidvarchar(40)YesNoneNull

load_balancer_id

bigint(20)

No

Mul

Null

certcertificate_id

bigint(20)

No

Mul

Null

revoke

tinyint(1)

No

None

0

...

Uploads a new SSL certificate-key pair

Request parameters:

  • cert certificate : Required : The public certificate, should also include the trust chain if required
  • key privatekey : Required : The private key for the certificate, if the key is encrypted, password should be provided
  • chain: Optional : The certificate chain
  • password: Optional : The password for the private key
  • account: Optional : The account to associate with the cert
  • domainid: Optional : The domain to associate with the cert
  • projectid: Optional : The project to associate with the cert

Response parameters:

  • id : The ID of the certificate
  • account : The account of the SSL certificate
  • cert : public certificate
  • key : private key
  • chain : The certificate chain

deleteSSLCert

Deletes an existing SSL cert from cloudstack.

Request parameters:

  • id : Required domainid : The domain id of associated with the certificatecert

Response parameters:

  • displaytext : any text domain : The domain name associated with the success or failure
  • success : true if operation is executed successfully

updateSSLCert

updates an existing certificate-key pair

Request parameters:

  • id : Required: The id of the certificate
  • cert : Optional : The public certificate, should also include the trust chain if required
  • key : Optional : The private key for the certificate, if the key is encrypted, password should be provided
  • password: Optional : The password for the private key
  • chain : The certificate chain

Response parameters:

  • id : The id of the certificate
  • cert : The public certificate, should also include the trust chain if required
  • key : The private key for the certificate, if the key is encrypted, password should be provided
  • chain : The certificate chain

listSSLCerts

  • cert
    -- either --
  • account : The account associated with the cert
    -- or --
  • projectid : The project id associated with the cert
  • project : The project name associated with the cert
http://10.x.x.x:8080/client/api?command=uploadSslCert&certificate=-----BEGIN+CERTIFICATE-----<certificate>-----END+CERTIFICATE-----&privatekey=-----BEGIN+RSA+PRIVATE+KEY----<privatekey>-----END+RSA+PRIVATE+KEY-----

Note : The certificate,key and chain should be UTF-encoded in the URL.

deleteSSLCert

Deletes an existing SSL cert from cloudstack.lists the certificates for an Id or an account

Request parameters:

  • id : Optional Required : The id of the certificateaccountid

Response parameters:

...

  • displaytext : any text associated with the success or failure
  • success : true if operation is executed successfully
http://10.x.x.x:8080/client/api?command=deleteSslCert&id=7

listSSLCerts

...

The response is a list of following

  • id : The id of the certificate
  • cert : The public certificate, should also include the trust chain if required
  • key : The private key for the certificate, if the key is encrypted, password should be provided
  • chain : The certificate chain
  • account : Account The account associated with the certificate
  • lbruleid : The lb rule associated with the certificate
  • projectid : The project associated with the certificate

...

http://10.x.x.x:8080/client/api?command=listSslCerts&accountid=2

New Apis  to add SSL cets to LBs

For associating the certificates to loadbalancing rules, we need to add have the certificate id parameter to following loadbalancer apis.

assignToLoadBalancerRule

Request parameter to be added:

following APIs

assignCertToLoadBalancer

Request parametes:

  • certid: Required certificateid: Optional : The id of the certificate to assign to this rule.

...

  • lb_id:Required : The lb rule to assign the cert to
http://10.x.x.x:8080/client/api?command=assignCertToLoadBalancer&certid=138ad12e-a486-44e3-bb02-7a55d0813174&lbruleid=47

 

removeCertFromLoadBalancer

Request parameter to be added:

  • certificateidlbruleid: Optional : The id of the certificate to remove from this rule.
http://10.x.x.x:8080/client/api?command=removeCertFromLoadBalancer&lbruleid=47

UI flow

The certificates can be accessed as a tab on the Accounts page.

...