[chef] Re: Re: http_request resource using client certificates

[Daniel DeLeo < >]

On Friday, February 27, 2015 at 3:37 PM, Peter Burkholder wrote:

> Would the right solution be extending http_request 
> (https://docs.chef.io/resource_http_request.html) to have attributes for 
> client_cert and client_key?
>  
>  
>  
>  
> On Fri, Feb 27, 2015 at 5:11 PM, Mark Selby 
> <
 
>  
> (mailto:
 )>
>  wrote:
> > Something new has popped in my environment whereby I need to make 
> > http_requests while supplying client side certificates for 
> > authentication. This is relatively easy to do using native Ruby code 
> > (snippet below) but no so easy using the existing http_request resource. 
> > Using the built in resource would require constructing all of the headers 
> > by hand which is a black art as far as I can tell.
> >  
> > Before I write my own LWRP I want to know if anyone else has come across 
> > this requirement and solved it with either custom code or figuring out 
> > the additional headers that need to be supplied to http_request.
Chef can already configure this globally. `ssl_client_cert` and 
`ssl_client_key` are the settings you want. See 
https://docs.chef.io/chef_client_security.html#client-rb-settings The ;
relevant code is here: 
https://github.com/chef/chef/blob/master/lib/chef/http/ssl_policies.rb

So you could try configuring that globally and see if it works. Though it’s 
kinda ugly since clearly it’d be better to configure for just the one 
request. It’s probably possible to do that by munging Chef::Config in 
ruby_blocks, though that’s ugly as well.

  
> >  
> > As always, any help is greatly appreciated.
> >  
> >  
> > #!/opt/chef/embedded/bin/ruby
> >  
> > require "net/https"
> > require "openssl"
> > require "uri"
> >  
> > uri = URI.parse("_SOME_URL_")
> >  
> > cert = File.open("_THE_CERT_") { |file| file.read }
> > key = File.open("_THE_KEY_") { |file| file.read }
> >  
> > http = Net::HTTP.new(uri.host, uri.port)
> > http.use_ssl = true
> > http.cert = OpenSSL::X509::Certificate.new(cert)
> > http.key = OpenSSL::PKey::RSA.new(key)
> > http.verify_mode = OpenSSL::SSL::VERIFY_NONE
> > res = http.get(uri.request_uri)
>  


I think you really want VERIFY_PEER here. If the server has a self-signed 
certificate, you can pull that down with `knife ssl fetch` or use some other 
means to copy it to Chef’s trusted certs dir. Seems kinda crazy that you’d go 
through the trouble to have the server verify the client like that and not 
have the client verify the server.
  

As Peter suggests, the most elegant thing to do would be to add support for 
mutual auth into the http_request resource. Feel free to reach out if you’d 
like to contribute such a thing but need help to do so.

HTH,

--  
Daniel DeLeo