bmcweb TLS certificates installation and management

bmcweb TLS certificates installation and management

[Zhenfei Tai]

[-- Attachment #1: Type: text/plain, Size: 520 bytes --]

Hi,

I'm recently looking into certificates installation and management for
bmcweb and hope to understand the best practice in this regard.

According to the TLS doc
<https://github.com/openbmc/docs/blob/master/security/TLS-configuration.md>,
bmcweb has APIs that allows root CA installation and https server
certificate replacement.

My questions are:

   - Should there be a separate workflow to manage certifications of BMCs?
   - Should the bmcweb APIs be used for the installation and management?


Thanks,
Zhenfei

[-- Attachment #2: Type: text/html, Size: 705 bytes --]

RE: [EXTERNAL] bmcweb TLS certificates installation and management

[Neeraj Ladkani]

[-- Attachment #1: Type: text/plain, Size: 1248 bytes --]

+1 as I had the same concerns. We can not use untrusted connection to provision certs.   It would be good to create a separate workflow to provision these certs.

Regards
N

From: openbmc <openbmc-bounces+neladk=microsoft.com@lists.ozlabs.org> On Behalf Of Zhenfei Tai
Sent: Thursday, July 23, 2020 5:46 PM
To: OpenBMC Maillist <openbmc@lists.ozlabs.org>
Subject: [EXTERNAL] bmcweb TLS certificates installation and management

Hi,

I'm recently looking into certificates installation and management for bmcweb and hope to understand the best practice in this regard.

According to the TLS doc<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fopenbmc%2Fdocs%2Fblob%2Fmaster%2Fsecurity%2FTLS-configuration.md&data=02%7C01%7Cneladk%40microsoft.com%7C846fee89707c417d83a208d82f6b216c%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637311484449788358&sdata=RIIF0B3muux2NEFx%2B401u7NQCFZ%2Fi4UdENIEwsVtGDI%3D&reserved=0>, bmcweb has APIs that allows root CA installation and https server certificate replacement.

My questions are:

  *   Should there be a separate workflow to manage certifications of BMCs?
  *   Should the bmcweb APIs be used for the installation and management?

Thanks,
Zhenfei


[-- Attachment #2: Type: text/html, Size: 6134 bytes --]