diff --git a/pages/RegenCertsEtc.md b/pages/RegenCertsEtc.md index 20ec5e0..9badd4a 100644 --- a/pages/RegenCertsEtc.md +++ b/pages/RegenCertsEtc.md @@ -1,5 +1,7 @@ # Hacking a New SSL Certificate Structure for Ganeti 2.12.x +Also see [this hack](https://github.com/ganeti/ganeti/issues/1627#issuecomment-994129465). + If you have somehow mashed the the server/client certificates on your cluster, or otherwise gotten into a deep SSL mess, and you, as we did, found the advice at [GanetiAndSSL](https://code.google.com/p/ganeti/wiki/GanetiAndSSL) did not work for you, then maybe the following will help. We speculate that the damage to our certs was caused during the upgrade from 2.11 to 2.12. There's lots of evidence from the mailing list postings that the change in security model bit a lot of people during the upgrade process. This recipe was hacked at some cost in source diving and certificate exploring (on a working cluster) by Rob Austein, Hans Kuhn, and Randy Bush. Be aware that this has only been tested for 2.12 and it's possible the security model will change in the future. There are no guarantees it will even work for your case and it is offered in the spirit of shared discovery. @@ -125,4 +127,7 @@ We were even able to generate a new generation of credentials. This command gen gnt-cluster renew-crypto --new-cluster-certificate ``` -Oddly, the client.pem objects, presumably generated by Ganeti itself when we told it to renew-crypto, were X.509v3 CA certificates, with BasicConstraints, AKI, and SKI extensions. Still self-signed, and no evidence that they signed anything else. \ No newline at end of file +Oddly, the client.pem objects, presumably generated by Ganeti itself when we told it to renew-crypto, were X.509v3 CA certificates, with BasicConstraints, AKI, and SKI extensions. Still self-signed, and no evidence that they signed anything else. + +--- +2023.06.30 \ No newline at end of file