...

Functional requirements & non-requirements

...

Architecture and Design description

...

Assumptions

• The SSL certificates should include the chain trust with them. They are added to the device as-is. ( Cert chain will be passed as an optional argument )
• For the netscaler loadbalancer, we assume that the port 22 is open and there is space in /nsconfig as we scp the certificate to the device.
• A loadbalancer rule can have only one certificate attached to it. A certificate however can be attached to multiple loadbalancers ( As long they are SSL type ). Support for multiple certificates for a single loadbalancer is not scoped.
• The certificate is not checked for validity at cloudstack level. The device errors if the certificate is invalid ( Certificate validation happens at cloudstack )

...

• when calling AssignToLoadBalancerRule if there is a certificate id in the request execute() method of the command calls
  assignSslCertToLoadBalancer(lb_id, certId) in LoadBalancingRulesManagerImpl
• assignSslCertToLoadBalancer checks if the loadbalancer is capable of SSL. If not error is returned.
• verify if other certificate is bound to the loadbalancer and if it is, return error
• It then verifies if the certificate is valid ( not revoked ) and creates an entry in the load_balancer_cert_map table
• the loadbalncer loadbalancer state is set to Add
• call the applyLoadBalancerConfig which calls applyLoadBalancerRules with the lbId
• getLoadBalancerRuleToApply function should also add getSslCertificates(lbId) which gets called from applyLoadBalancerConfig
• Now the rule has SSL certificate info as well.
• When the rules get applied by calling applyLBRules of the NetscalerElement, the SSL info is passed inside the rule.
• Netscaler should check for SslOffload Capability if the rule has certificate info.
• NetscalerElement creates a LoadBalancerTO which transfers the params to the resouce resource layer.
• The LoadBalancerTO should contain SslCertTO for holding certificate information.

...

• certificate : Required : The public certificate, should also include the trust chain if required
• privatekey : Required : The private key for the certificate, if the key is encrypted, password should be provided
• chain: Optional : The certificate chain
• password: Optional : The password for the private key
• account: Optional : The account to associate with the cert
• domainid: Optional : The domain to associate with the cert
• projectid: Optional : The project to associate with the cert

Response parameters:

• id : The ID of the certificate
• account : The account of the SSL certificate
• cert : public certificate
• key : private key
• chain : The certificate chain
• domainid : The domain id associated with the cert
• domain : The domain name associated with the cert
  -- either --
• account : The account associated with the cert
  -- or --
• projectid : The project id associated with the cert
• project : The project name associated with the cert

http://10.x.x.x:8080/client/api?command=uploadSslCert&certificate=-----BEGIN+CERTIFICATE-----<certificate>-----END+CERTIFICATE-----&privatekey=-----BEGIN+RSA+PRIVATE+KEY----<privatekey>-----END+RSA+PRIVATE+KEY-----

Note : The certificate,key and chain should be UTF-encoded in the URL.

deleteSSLCert

Deletes an existing SSL cert from cloudstack.

...

• displaytext : any text associated with the success or failure
• success : true if operation is executed successfully

http://10.x.x.x:8080/client/api?command=deleteSslCert&id=7

listSSLCerts

The response is a list of following

• id : The id of the certificate
• cert : The public certificate, should also include the trust chain if required
• key : The private key for the certificate, if the key is encrypted, password should be provided
• chain : The certificate chain
• account : Account The account associated with the certificate
• lbruleid : The lb rule associated with the certificate
• projectid : The project associated with the certificate

http://10.x.x.x:8080/client/api?command=listSslCerts&accountid=2

New Apis  to add SSL cets to LBs

...

• certid: Required : The id of the certificate to assign to this rule.
• lb_id:Requnred Required : The lb rule to assign the cert to

http://10.x.x.x:8080/client/api?command=assignCertToLoadBalancer&certid=138ad12e-a486-44e3-bb02-7a55d0813174&lbruleid=47

removeCertFromLoadBalancer

...

• lbruleid: Optional : The id of the certificate to remove from this rule.

http://10.x.x.x:8080/client/api?command=removeCertFromLoadBalancer&lbruleid=47

UI flow

The certificates can be accessed as a tab on the Accounts page.

...