[chef] Re: distribute ssl certs using encrypted data bags

[Brad Knowles < >]

On Jan 6, 2012, at 4:52 PM, 

 
 wrote:

> anyone have examples they can share on how they're disting ssl
> certificates from encrypted data bags? or, if not from data bags,
> how are you doing it?

We're using encrypted data bags.  Basically, just just cut-n-paste the key 
and the cert into an encrypted data bag, and then you have to put together a 
recipe to pull that stuff out of the encrypted data bag and hand the 
decrypted secret as a variable to your web.conf.erb template that is being 
used by the apache2 cookbook to create the actual website(s) you're serving.

For a sample certs.rb file, see 
<https://gist.github.com/b775da964e97a8b8c185>.  The corresponding .crt and 
.key files look like this:

-----BEGIN CERTIFICATE-----
<%= @ssl_cert %>
-----END CERTIFICATE-----
Tue Dec 20 15:03:52 CST 2011


-----BEGIN RSA PRIVATE KEY-----
<%= @ssl_key %>
-----END RSA PRIVATE KEY-----
Tue Dec 20 15:05:49 CST 2011


The corresponding domain_ssl.json file might look something like this (note 
that this is encrypted):

{
  "cert": 
"za90CmUqQhVYYwP4xgxoGnCdKMvjqOBl7e52mcgoBmkA6ofsFnjR/9oQ0P9x\n...LOTS.OF.GARBAGE.DELETED...\n5F1/WZjp8LyIAooI9Cz2w1eDQwuax0w3xAvc\n",
  "id": "domain_net_ssl",
  "key": 
"xRp8e8PNWfJFYzViJpqxF5+zwWrdm2roLxNtp75wh2so06nKzcuy3P0JvFV+\n...LOTS.OF.GARBAGE.DELETED...\nsgZdBrEsxAtgcH5A\n"
}


When stored in .json format, you will get the single continuous line like 
that, with what appear to be embedded newline characters.  However, you 
cut-n-paste the ASCII text version of the certificates and keys when you're 
creating the encrypted databag, and internally Chef will do the conversion 
for you.  Of course, once you create the encrypted data bag directly on the 
chef server, you might want to then re-export that back out to a local file 
that you can store in the encrypted format, which is how I was able to 
provide the listing above.

Works well for us.


Of course, we did come very late to the party where we discovered that 
wildcard certs like *.domain.tld doesn't mean that you can use them to serve 
up proper SSL-secured sites with names like 
service.subdomain.subdomain.domain.tld, because the wildcard explicitly 
EXCLUDES the dot character.  So, if you also want to serve up subdomains and 
subsubdomains and use wildcard certs for those as well, then you'll need to 
buy extra wildcard certs at each level.  Blech.

-- 
Brad Knowles 
<
 >
SAGE Level IV, Chef Level 0.0.1