Using Custom Signed Certificates with Object Store

Alternatives to Using the HPE-Provided Certificates

If you do not want to use the default self-signed certificates, you have two options:

• Option 1: Obtain a public certificate and private key from a well-known certificate authority, such as Verisign or Comodo. Then replace the default public.crt and private.key files with the new public certificate and private key. If you choose Option 1, you must perform only steps 6 and later in the following procedures
• Option 2: Generate your own self-signed certificates to replace the public.crt and private.key files provided in the default installation. If you choose Option 2, perform all steps in the following procedure.

Generating Your Own Self-Signed Certificates

1. Use the OpenSSL utility to create your own root CA certificate and CA private key:

   openssl req -x509 -sha256 -days 356 -nodes -newkey rsa:2048 -subj "/CN=*.<domain_name>/C=IN/L=HYD" -keyout rootCA.key -out rootCA.crt

   where <domain_name> is your domain (for example, mydomain.mycorp.net).
2. Create a private key to generate the certificate signing request (CSR):

   openssl genrsa -out private.key 2048

3. Create the CSR configuration. Be sure to provide all required information. For example:

   csr.conf
   =========
   [ req ]
   default_bits = 2048
   prompt = no
   default_md = sha256
   req_extensions = req_ext
   distinguished_name = dn
   [ dn ]
   C = IN
   ST = TEL
   L = HYD
   O = HPE
   OU = QA
   CN = *.<domain_name>
   [ req_ext ]
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = *.<domain_name>

4. Generate the CSR using a private key. For example:

   openssl req -new -key private.key -out server.csr -config csr.conf

5. Using the root CA and CA private key, create an SSL certificate with the CSR:
   1. Create the cert.conf file. For example:

      cert.conf
      ==========
      basicConstraints=CA:FALSE
      keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = *.<domain_name>

   2. Generate the SSL certificate with the self-signed CA:

      openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out public.crt -days 365 -sha256 -extfile cert.conf

      You should now have the following files:
      • private.key
      • server.csr
      • rootCA.crt
      • rootCA.key
      • public.crt
6. Stop the Multithreaded Object Store Server (MOSS) service:

   maprcli node services -nodes <node_name> -name s3server -action stop -json

7. Use OpenSSL and the keytool command to add the custom certificates to the ssl_userkeystore and ssl_usertruststore so that the MOSS public.crt and private.key are available from these files:
   1. Use the openssl command to generate the keypair.p12 file. For the <password>, specify a new password of your choosing:

      openssl pkcs12 -export -nodes -passout pass:<password> -in public.crt -inkey private.key -name moss -out keypair.p12

   2. Use the keytool command to import the key store:

      For this password variable . . .	Use
      <keystore password>	The password for the ssl.server.keystore.password key displayed in the /opt/mapr/conf/store-passwords.txt file.
      <password>	The new password you specified in step 7a.

      keytool -importkeystore -deststorepass <keystore password> -destkeystore /opt/mapr/conf/ssl_userkeystore.p12 -srckeystore keypair.p12 -srcstorepass <password> -srcstoretype PKCS12

   3. When prompted to overwrite the entry, specify yes:

      Existing entry alias moss exists, overwrite? [no]: yes

   4. Use the keytool command to delete the MOSS key store:

      keytool -delete -noprompt -alias "moss" -keystore /opt/mapr/conf/ssl_usertruststore.p12

   5. When prompted for the keystore password, use the password for the ssl.server.truststore.password key displayed in the /opt/mapr/conf/store-passwords.txt file:

      Enter keystore password: 

   6. Use the keytool command to import the public.crt:

      keytool -importcert -alias moss -file public.crt -keystore /opt/mapr/conf/ssl_usertruststore.p12

   7. When prompted for the keystore password, use the password for the ssl.server.truststore.password key displayed in the /opt/mapr/conf/store-passwords.txt file:

      Enter keystore password: 

   8. Use the keytool command to delete the MOSS key store. For the <truststore password>, use the password for the ssl.server.truststore.password key displayed in the /opt/mapr/conf/store-passwords.txt file:

      keytool -delete -noprompt -alias "moss" -keystore /opt/mapr/conf/ssl_usertruststore -storepass <truststore password>

   9. Use the following command to add the public.crt to the key store. For the <truststore password>, use the password for the ssl.server.truststore.password key displayed in the /opt/mapr/conf/store-passwords.txt file:

      keytool -importcert -alias moss -file public.crt -keystore /opt/mapr/conf/ssl_usertruststore -storepass <truststore password>

   10. When the following prompt appears, type yes:

       Trust this certificate? [no]: yes

   11. On all other nodes where the MOSS service is running, replace these files:
       • /opt/mapr/conf/ssl_usertruststore
       • /opt/mapr/conf/ssl_usertruststore.p12
       • /opt/mapr/conf/ssl_userkeystore.p12
   12. Restart the MOSS service:

       maprcli node services -nodes <node_name> -name s3server -action start

8. Copy the public certificate to the /.mc/certs/CAs/ directory:

   cp /opt/mapr/conf/public.crt ~/.mc/certs/CAs/

9. Use mc commands to create an alias bucket to confirm that MOSS uses the newly generated self-signed certificates. For example:
   1. Use the following command to create a bucket:

      /opt/mapr/bin/mc mb alias/<bucket_name>

   2. Use the following command to copy an object to the bucket you created in step 9a. If you are successful, the Object Store is loaded with the custom certificates:

      /opt/mapr/bin/mc cp /root/file.txt alias/<bucket_name>