mirror of
https://github.com/bigchaindb/bigchaindb.git
synced 2024-10-13 13:34:05 +00:00
b6ec3e5f5c
* Support for secure TLS communication in MongoDB, MongoDB Monitoring Agent and MongoDB Backup Agent - Move from Golang to Bash for entrypoint program - Update image tag to 2.0 for Backup and Monitoring Agents and to 3.4.4 for MongoDB - Add documentation * changed title & rewrote Step 1 of workflow.rst * copy-edited ca-installation.rst * copy-edited & modified structure of workflow.rst * moved repeated Easy-RSA install & config docs to new page * edited the sentences describing the Easy-RSA dirs * copy-edited the page about generating server certificate * copy-edited the page about generating client certificate * renamed page to 'How to Set Up a Self-Signed Certificate Authority' * copy-edited page about how to revoke a certificate * Comments on how to uniquely name all instances in the cluster * Added comments about the other questions when setting up a CA * Added note about one Agent Api Key per Cloud Manager backup * docs: clarified instructions for generating server CSR * docs: added back 'from your PKI infrastructure' * docs: fixed step & added step re/ FQDNs & certs in workflow.rst * docs: added note re/ the Distinguished Name * Update docs for env vars setup * docs: added tip: how to get help with the easyrsa command
85 lines
2.5 KiB
ReStructuredText
85 lines
2.5 KiB
ReStructuredText
How to Install & Configure Easy-RSA
|
|
===================================
|
|
|
|
We use
|
|
`Easy-RSA version 3
|
|
<https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto>`_, a
|
|
wrapper over complex ``openssl`` commands.
|
|
`Easy-RSA is available on GitHub <https://github.com/OpenVPN/easy-rsa/releases>`_ and licensed under GPLv2.
|
|
|
|
|
|
Step 1: Install Easy-RSA Dependencies
|
|
-------------------------------------
|
|
|
|
The only dependency for Easy-RSA v3 is ``openssl``,
|
|
which is available from the ``openssl`` package on Ubuntu and other
|
|
Debian-based operating systems, i.e. you can install it using:
|
|
|
|
.. code:: bash
|
|
|
|
sudo apt-get update
|
|
|
|
sudo apt-get install openssl
|
|
|
|
|
|
Step 2: Install Easy-RSA
|
|
------------------------
|
|
|
|
Make sure you're in the directory where you want Easy-RSA to live,
|
|
then download it and extract it within that directory:
|
|
|
|
.. code:: bash
|
|
|
|
wget https://github.com/OpenVPN/easy-rsa/archive/3.0.1.tar.gz
|
|
|
|
tar xzvf 3.0.1.tar.gz
|
|
|
|
rm 3.0.1.tar.gz
|
|
|
|
There should now be a directory named ``easy-rsa-3.0.1``
|
|
in your current directory.
|
|
|
|
|
|
Step 3: Customize the Easy-RSA Configuration
|
|
--------------------------------------------
|
|
|
|
We now create a config file named ``vars``
|
|
by copying the existing ``vars.example`` file
|
|
and then editing it.
|
|
You should change the
|
|
country, province, city, org and email
|
|
to the correct values for you.
|
|
(Note: The country, province, city, org and email are part of
|
|
the `Distinguished Name <https://en.wikipedia.org/wiki/X.509#Certificates>`_ (DN).)
|
|
The comments in the file explain what the variables mean.
|
|
|
|
.. code:: bash
|
|
|
|
cd easy-rsa-3.0.1/easyrsa3
|
|
|
|
cp vars.example vars
|
|
|
|
echo 'set_var EASYRSA_DN "org"' >> vars
|
|
echo 'set_var EASYRSA_REQ_OU "IT"' >> vars
|
|
echo 'set_var EASYRSA_KEY_SIZE 4096' >> vars
|
|
|
|
echo 'set_var EASYRSA_REQ_COUNTRY "DE"' >> vars
|
|
echo 'set_var EASYRSA_REQ_PROVINCE "Berlin"' >> vars
|
|
echo 'set_var EASYRSA_REQ_CITY "Berlin"' >> vars
|
|
echo 'set_var EASYRSA_REQ_ORG "BigchainDB GmbH"' >> vars
|
|
echo 'set_var EASYRSA_REQ_EMAIL "dev@bigchaindb.com"' >> vars
|
|
|
|
|
|
Step 4: Maybe Edit x509-types/server
|
|
------------------------------------
|
|
|
|
.. warning::
|
|
|
|
Only do this step if you are setting up a self-signed CA
|
|
or creating a server/member certificate.
|
|
|
|
Edit the file ``x509-types/server`` and change
|
|
``extendedKeyUsage = serverAuth`` to
|
|
``extendedKeyUsage = serverAuth,clientAuth``.
|
|
See `the MongoDB documentation about x.509 authentication <https://docs.mongodb.com/manual/core/security-x.509/>`_ to understand why.
|