Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Corrections in certificates docs #2513

Merged
merged 2 commits into from
Sep 18, 2019
Merged

Corrections in certificates docs #2513

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d0f68f7
Corrections in certificates docs
stuclem Sep 13, 2019
1509674
Comments from Jun
stuclem Sep 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions docs/user_doc/vic_vsphere_admin/vch_cert_reqs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ For information about how to automatically generate a server certificate during
Custom server certificates for VCHs must meet the following requirements:

- You must use an X.509 server certificate.
- The Common Name (CN) in the server certificate must match the FQDN or IP address of the system from which the Docker client accesses the server, or a wildcard domain that matches all of the FQDNs in a specific subdomain.
- The Common Name (CN) in the server certificate must match the FQDN or IP address of the system from which the Docker client accesses the server, or a wildcard domain that matches all of the FQDNs in a specific subdomain.
- Server certificates must have the following certificate usages:
- `KeyEncipherment`
- `DigitalSignature`
Expand All @@ -110,8 +110,6 @@ Custom server certificates for VCHs must meet the following requirements:

If you use certificates that are not signed by a trusted certificate authority, container developers might require the server certificate when they run Docker commands in `--tlsverify` client mode. You can download the server certificate for a VCH from the vSphere Client. For information about downloading server certificates, see [View All VCH and Container Information in the HTML5 vSphere Client](access_h5_ui.md).

For information about how to upload custom client certificates during VCH deployment, see the section [Server Certificates](vch_cert_options.md#server) in *Virtual Container Host Certificate Options*.

## VCH Client Certificate <a id="clientcert"></a>

vSphere Integrated Containers Management Portal uses a client certificate to authenticate with the VCH when you add it to a project.
Expand All @@ -128,17 +126,16 @@ For information about how to automatically generate a client certificate during

### Custom Client Certificate <a id="clientcert"></a>

For the VCH to trust the CA that you use to sign the client certificate, the CA must include the following elements:
For the VCH to trust the CA that you use to sign the client certificate, the client certificate must include the following elements:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the first part and only keep "The client certificate must include the following elements:"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 1509674.


- The name or address of the system from which the Docker client accesses the server in the subject or subject alternative name. This can be an FQDN or a wildcard domain.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove this requirement that actually made the user confusion in the bug.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 1509674.

- Key usage in the v3 extensions that match the key usage chosen for the VCH server certificate:
- `KeyEncipherment`
- `KeyAgreement`
- `clientAuth`

You cannot download client certificates for VCHs from the vSphere Client. vSphere administrators distribute client certificates directly.

For information about how to upload custom client certificates during VCH deployment, see the section [Client Certificates](vch_cert_options.md#client) in *Virtual Container Host Certificate Options*.

## vSphere Integrated Containers Registry Root CA <a id="registry"></a>

VCH requires registry root CA to pull images from vSphere Integrated Containers Registry
Expand Down