Allow test-with-ssl-plugin to be used in FIPS #66554
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Selectively use PEM files instead of keystores so that the plugin can be applied to projects even if these would run in fips mode
|
Pinging @elastic/es-delivery (Team:Delivery) |
|
@elasticmachine update branch |
ywangd
approved these changes
Dec 23, 2020
| @@ -18,3 +18,11 @@ The certificates are generated using catch-all SAN in the following procedure: | |||
| `keytool -export -alias test-client -keystore test-client.jks -storepass keypass -file test-client.crt` | |||
| 6. Import the client certificate in the node's keystore: | |||
| `keytool -import -alias test-client -keystore test-node.jks -storepass keypass -file test-client.crt -noprompt` | |||
| 7. Convert the node's keystore to PKCS#12 temporarily so that we can export the private key ( as keytool doesn't allow this) | |||
| `keytool -importkeystore -srckeystore test-node.jks -srcstorepass keypass -destkeystore test-node.p12 -deststoretype PKCS12 -deststorepass keypass` | |||
| 8. Export the client's private key | |||
There was a problem hiding this comment.
Suggested change
| 8. Export the client's private key | |
| 8. Export the node's private key |
| `keytool -importkeystore -srckeystore test-node.jks -srcstorepass keypass -destkeystore test-node.p12 -deststoretype PKCS12 -deststorepass keypass` | ||
| 8. Export the client's private key | ||
| `openssl pkcs12 -in test-node.p12 -passin pass:keypass -nocerts -nodes -out test-node.key` | ||
| 9. Convert the node's keystore to PKCS#12 temporarily so that we can export the private key ( as keytool doesn't allow this) |
There was a problem hiding this comment.
Suggested change
| 9. Convert the node's keystore to PKCS#12 temporarily so that we can export the private key ( as keytool doesn't allow this) | |
| 9. Convert the client's keystore to PKCS#12 temporarily so that we can export the private key ( as keytool doesn't allow this) |
| 7. Convert the node's keystore to PKCS#12 temporarily so that we can export the private key ( as keytool doesn't allow this) | ||
| `keytool -importkeystore -srckeystore test-node.jks -srcstorepass keypass -destkeystore test-node.p12 -deststoretype PKCS12 -deststorepass keypass` | ||
| 8. Export the client's private key | ||
| `openssl pkcs12 -in test-node.p12 -passin pass:keypass -nocerts -nodes -out test-node.key` |
There was a problem hiding this comment.
Is there any value to have encryption here? Since this file is mainly used for testing FIPS, so most likely the private key will be encrypted in the wild.
There was a problem hiding this comment.
I think we have enough coverage for this in unit tests, but on the other hand, why not ? :)
|
@elasticmachine update branch |
|
@elasticmachine update branch |
jkakavas
added a commit
to jkakavas/elasticsearch
that referenced
this pull request
Jan 15, 2021
Selectively use PEM files instead of keystores so that the plugin can be applied to projects even if these would run in fips mode
jkakavas
added a commit
that referenced
this pull request
Jan 15, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Selectively use PEM files instead of keystores so that the plugin
can be applied to projects even if these would run in fips mode