Devs, Following a discussion with a client they came up with the idea to create a pluggable CA-framework. A plugin would serve components in cloudstack that so require (management servers, agents, load balancers, SVMs, etc.) with certificates answering certificate requests and validating certificates on request.
A default plugin can be written that serves according to its own self signed root certificate and have its own revocation list to be managed by the admin. Other plugin could forward by mail or web requests to external parties. A CA-plugin will have to - Setup, for the default this means creating its certificate, for others it might mean install an intermediate certificate or configure a mail, or website address. - Accept and answer certificate requests o For client certificates o For server certificates - Accept revocation requests - Validate a connection request according to origin and certificate and <extra data>. What extra data is is defined by the plugin and can be credentials or field-definitions referring the x509 entries or for instance port numbers allowed… this is basically free to the implementer. A next step will have to be integrating the request calls with installs on targets but I think as is this feature merits itself as it could be used with out of band configuration management tools as well. Any thoughts, remarks and critiques are welcome, daan.hoogl...@shapeblue.com www.shapeblue.com 53 Chandos Place, Covent Garden, London WC2N 4HSUK @shapeblue
