{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/9710","repository_url":"https://api.github.com/repos/openshift/openshift-ansible","labels_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/9710/labels{/name}","comments_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/9710/comments","events_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/9710/events","html_url":"https://github.com/openshift/openshift-ansible/issues/9710","id":352729662,"node_id":"MDU6SXNzdWUzNTI3Mjk2NjI=","number":9710,"title":"Lack of info  configuring Custom Certificates for the Web Console","user":{"login":"DanyC97","id":7383422,"node_id":"MDQ6VXNlcjczODM0MjI=","avatar_url":"https://avatars0.githubusercontent.com/u/7383422?v=4","gravatar_id":"","url":"https://api.github.com/users/DanyC97","html_url":"https://github.com/DanyC97","followers_url":"https://api.github.com/users/DanyC97/followers","following_url":"https://api.github.com/users/DanyC97/following{/other_user}","gists_url":"https://api.github.com/users/DanyC97/gists{/gist_id}","starred_url":"https://api.github.com/users/DanyC97/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanyC97/subscriptions","organizations_url":"https://api.github.com/users/DanyC97/orgs","repos_url":"https://api.github.com/users/DanyC97/repos","events_url":"https://api.github.com/users/DanyC97/events{/privacy}","received_events_url":"https://api.github.com/users/DanyC97/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2018-08-21T22:10:06Z","updated_at":"2018-08-24T09:09:05Z","closed_at":"2018-08-23T18:26:15Z","author_association":"CONTRIBUTOR","body":"For the last few days i was trying on a Origin/ ansible v3.7 to create and deploy custom certification on existing cluster so i can get rid of the annoying browser warning.\r\n\r\nSo far it feels like a never ending process due to lack of consistent documentation ...\r\n\r\nWhat i've done\r\n\r\n* after many trial and errors i was made [aware](https://github.com/openshift/openshift-ansible/pull/4920#issuecomment-414442885) by @abutcher about a very good guide which explain how to create the certs for private/ internal domains\r\n* copied `openshift-master.private.dani.com.cert.pem` & `openshift-master.private.dani.com.key.pem` to each master under `/etc/origin/master/`\r\n* manually set the `master-config.yaml` as below and restarted the `origin-master-api.service` & `origin-master-controller.service`\r\n\r\n```\r\nassetConfig:\r\n  extensionScripts:\r\n  - /etc/origin/master/openshift-ansible-catalog-console.js\r\n  logoutURL: ''\r\n  masterPublicURL: https://openshift-master.private.dani.com:8443\r\n  publicURL: https://openshift-master.private.dani.com:8443/console/\r\n  servingInfo:\r\n    bindAddress: 0.0.0.0:8443\r\n    bindNetwork: tcp4\r\n    certFile: master.server.crt\r\n    clientCA: ''\r\n    keyFile: master.server.key\r\n    maxRequestsInFlight: 0\r\n    requestTimeoutSeconds: 0\r\n    namedCertificates:\r\n      - certFile: openshift-master.private.dani.com.cert.pem\r\n        keyFile: openshift-master.private.dani.com.key.pem\r\n        names:\r\n          - \"openshift-master.private.dani.com\"\r\n...\r\noauthConfig:\r\n  masterURL: https://openshift-master-int.private.dani.com:8443\r\n```\r\nhowever accessing the web console is still retrieving the default self-signed master certificate. Even when doing `openssl s_client -showcerts -connect openshift-master.private.dani.com:8443 -servername openshift-master.private.dani.com` i get same result\r\n\r\n**Findings**:\r\n\r\nthinking that i've done something wrong, i decided to try the automation thinking there is one ... .wrong decision which cost me 1 day!\r\n\r\n* 3.7 [docs](https://docs.openshift.com/container-platform/3.7/install_config/certificate_customization.html#configuring-custom-certificates) (same info is in 3.10) mention how to set custom certs for web console \r\n* you would think for an existing cluster you would need to redeploy the certs as mentioned [here](https://docs.openshift.com/container-platform/3.7/install_config/redeploying_certificates.html#redeploying-master-certificates) however what is not being mention at all is the info i came across in [this BZ](https://bugzilla.redhat.com/show_bug.cgi?id=1553102#c2)\r\n   * and if you come across https://github.com/openshift/openshift-docs/issues/7495#issuecomment-364319969 you would think that to automate the whole process (including the adding the right info into `master-config.yaml`) you must run `edeploy-master-certificates.yml` ... wrong !\r\n* even for a green/ fresh deployment, setting http://v1.uncontained.io/playbooks/installation/custom_certificates.html#master-api-certificate it won't be enough since the below snippet is not automated \r\n\r\n```\r\nnamedCertificates:\r\n      - certFile: openshift-master.private.dani.com.cert.pem\r\n        keyFile: openshift-master.private.dani.com.key.pem\r\n        names:\r\n          - \"openshift-master.private.dani.com\"\r\n\r\n```\r\n\r\n@abutcher as the contributor of the named_certificate role, any chance you can share more info around how the internals works:\r\n\r\n1) for the new custom certs created by following [this guide](https://jamielinux.com/docs/openssl-certificate-authority/index.html) do i need to drop the intermediate CA ? \r\n2) since `cafile` is not used, how does the custom certs know/ works with the selg-signed generated internal certs ? \r\n3) the `certFile` value does it needs to be a chain file ? - see [here](https://jamielinux.com/docs/openssl-certificate-authority/create-the-intermediate-pair.html#create-the-certificate-chain-file)\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/comments/415700874","html_url":"https://github.com/openshift/openshift-ansible/issues/9710#issuecomment-415700874","issue_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/9710","id":415700874,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTcwMDg3NA==","user":{"login":"DanyC97","id":7383422,"node_id":"MDQ6VXNlcjczODM0MjI=","avatar_url":"https://avatars0.githubusercontent.com/u/7383422?v=4","gravatar_id":"","url":"https://api.github.com/users/DanyC97","html_url":"https://github.com/DanyC97","followers_url":"https://api.github.com/users/DanyC97/followers","following_url":"https://api.github.com/users/DanyC97/following{/other_user}","gists_url":"https://api.github.com/users/DanyC97/gists{/gist_id}","starred_url":"https://api.github.com/users/DanyC97/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanyC97/subscriptions","organizations_url":"https://api.github.com/users/DanyC97/orgs","repos_url":"https://api.github.com/users/DanyC97/repos","events_url":"https://api.github.com/users/DanyC97/events{/privacy}","received_events_url":"https://api.github.com/users/DanyC97/received_events","type":"User","site_admin":false},"created_at":"2018-08-24T09:09:05Z","updated_at":"2018-08-24T09:09:05Z","author_association":"CONTRIBUTOR","body":"@rackergs sure, i'll deal with the docs soon."}}
{"actor":{"display_login":"DanyC97"}}