lablup / lablup/backend.ai

Add support of password file in loading SSL certificates

Open
#310 1 comment 0 reactions 0 assignees View on GitHub
comp:manager comp:storage-proxy comp:webserver
Dominant language
Python
Stars
670
Forks
183
Avg merge
17h 7m
Merged PRs (30d)
358

Description

Manager, Storage-Proxy, etc. supports HTTPS mode by loading SSL certificate chain. However, they cannot load the certificates encrypted with a pass phrase (password file). For more security, we are better to support the loading of SSL certificate chain with a pass phrase.

For example in Manager, the cert chain is loaded in the following lines:
https://github.com/lablup/backend.ai-manager/blob/d180e9b441b0ea95b9d4ae980191988621928019/src/ai/backend/manager/server.py#L589-L592

The `load_cert_chain` actually supports the [`password` parameter](https://pythontic.com/ssl/sslcontext/load_cert_chain), so we can just append a password file if exists. `manager.toml` should also support the `ssl-password` field under the `[manager]` section.

Target services: Manager, Storage-Proxy, Webserver, etc.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.