May First Cerificate Authority

While May First mostly depends on Lets Encrypt for our PKI infrastructure, we do operate our own certificatte authority for signing certificates in our dev and/or testing environment and for internal only connections.

The certificate authority key is saved in our ansible vault using the variable name vault_mfca_key and the signed certificate key is stored in the variable mayfirst_mfca_cert.

The certificate is saved to the directory /usr/local/share/ca-certificates/mfca.crt, which is picked up by the ca-certificates debian package and incorporated into the /etc/ssl/certs directory so all local applications will trust certificates signed by our key.

The certificate is generally signed for 3 years which means it needs to be periodically renewed.

To renew it:

  1. Extract the private key (the value of the variable vault_mfca_key) by running ansible-vault edit secrets.ytml and save to a file called mfca.key.
  2. Copy the value in hosts.yml with variable name mayfirst_mfca_cer to a file named mfca.crt.
  3. Create a certificate signing request: openssl x509 -x509toreq -in mfca.crt -signkey mfca.key -out new-server.csr
  4. Create the file ca.conf with the contents:
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
  1. Sign it:
openssl x509 \
    -req \
    -extensions v3_ca \
    -extfile ca.conf \
    -days 1024 \
    -in new-server.csr \
    -signkey mfca.key \
    -out new-cacert.pem`
  1. Copy new cert over old cert: mv new-cacert.pem mfca.crt
  2. Copy contents of mfca.crt to the mayfirst_mfca_cert variable in hosts.yml
  3. Copy to all servers: sower --live playbook --tags mayfirst-mfca-cert
  4. Optioanlly copy mfca.crt to your /usr/local/share/ca-certificates/mfca.crt and run sudo dpkg-reconfigure ca-certificates and import it into your browser.