)]}'
{"doc/source/admin/guides/certificates.rst":[{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"8fcc41da5e5e4806d86941152847c6e60a8cfa4a","unresolved":false,"context_lines":[{"line_number":22,"context_line":"and control of :term:`Amphora`."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"This guide does not apply to the configuration of `TERMINATED_TLS` listeners"},{"line_number":25,"context_line":"on load balancers. See the `Load Balancing Cookbook \u003c../../user/guides/basic-cookbook.html#deploy-a-tls-terminated-https-load-balancer\u003e`_ for instructions on"},{"line_number":26,"context_line":"creating `TERMINATED_TLS` listeners."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Two-way TLS Authentication in Octavia"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_81e7a0d7","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":157},"updated":"2018-10-26 07:26:19.000000000","message":"doc/source/admin/guides/certificates.rst:25: D001 Line too long","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":18784,"name":"Michael Carden","email":"mike.carden@gmail.com","username":"mcarden"},"change_message_id":"36e68d9e5a28df6d542b425b9a220343741633d6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"---------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"When a controller process, such as the Octavia worker process, connects to"},{"line_number":45,"context_line":"an Amphora, the Amphora will present it\u0027s `server` certificate"},{"line_number":46,"context_line":"to the controller. The controller will then validate it against the `server`"},{"line_number":47,"context_line":"Certificate Authority (CA) certificate stored on the controller. If the"},{"line_number":48,"context_line":"presented certificate is validated against the `server` CA certificate, the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_726a5818","line":45,"range":{"start_line":45,"start_character":37,"end_line":45,"end_character":41},"updated":"2018-10-26 00:55:48.000000000","message":"its","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":18784,"name":"Michael Carden","email":"mike.carden@gmail.com","username":"mcarden"},"change_message_id":"36e68d9e5a28df6d542b425b9a220343741633d6","unresolved":false,"context_lines":[{"line_number":51,"context_line":"Phase Two"},{"line_number":52,"context_line":"---------"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Once phase one is complete, the controller will present it\u0027s `client`"},{"line_number":55,"context_line":"certificate to the Amphora. The Amphora will then validate the"},{"line_number":56,"context_line":"certificate against the `client` CA certificate stored inside the Amphora."},{"line_number":57,"context_line":"If this certificate is successfully validated, the rest of the TLS handshake"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_d2548c58","line":54,"range":{"start_line":54,"start_character":56,"end_line":54,"end_character":60},"updated":"2018-10-26 00:55:48.000000000","message":"its","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":18784,"name":"Michael Carden","email":"mike.carden@gmail.com","username":"mcarden"},"change_message_id":"36e68d9e5a28df6d542b425b9a220343741633d6","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"        $ openssl ca -config ../openssl.cnf -extensions usr_cert -days 7300 -notext -md sha256 -in csr/client.csr.pem -out certs/client.cert.pem"},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"14. Create a concatonated `client` certificate and key file."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    .. code-block:: bash"},{"line_number":229,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_32c70014","line":226,"range":{"start_line":226,"start_character":13,"end_line":226,"end_character":25},"updated":"2018-10-26 00:55:48.000000000","message":"concatenated","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"8fcc41da5e5e4806d86941152847c6e60a8cfa4a","unresolved":false,"context_lines":[{"line_number":228,"context_line":"    .. code-block:: bash"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"        $ openssl rsa -in private/client.key.pem -out private/client.cert-key.pem"},{"line_number":231,"context_line":"        $ cat certs/client.cert.pem \u003e\u003e private/client.cert-key.pem"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Configuring Octavia"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_81cec055","line":231,"range":{"start_line":231,"start_character":8,"end_line":231,"end_character":66},"updated":"2018-10-26 07:26:19.000000000","message":"Perhaps make this clearer by naming it client.pem or client.cert-and-key.pem to avoid confusion?","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"8fcc41da5e5e4806d86941152847c6e60a8cfa4a","unresolved":false,"context_lines":[{"line_number":295,"context_line":"   .. code-block:: ini"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"       [haproxy_amphora]"},{"line_number":298,"context_line":"       client_cert \u003d /etc/octavia/certs/client.cert-key.pem"},{"line_number":299,"context_line":"       server_ca \u003d /etc/octavia/certs/server_ca.cert.pem"},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"5. Start the controller processes."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f79a3b5_a1cdfc5e","line":298,"range":{"start_line":298,"start_character":22,"end_line":298,"end_character":59},"updated":"2018-10-26 07:26:19.000000000","message":"^","commit_id":"c47173a8442c1561dd8fac6e3c5eda33fbfbf653"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"4a429ec375ac13897100e30d20fad429a840eac8","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"    .. code-block:: bash"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        $ openssl genrsa -aes256 -out private/client.key.pem 2048"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"12. Create the certificate request for the `client` certificate used on the"},{"line_number":205,"context_line":"    controllers."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_8c1ba91b","line":202,"range":{"start_line":202,"start_character":25,"end_line":202,"end_character":32},"updated":"2018-11-05 15:27:07.000000000","message":"The client key should not be password protected","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"change_message_id":"2b7010645182cbff6711594c1ed89420552a2abc","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"    .. code-block:: bash"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        $ openssl genrsa -aes256 -out private/client.key.pem 2048"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"12. Create the certificate request for the `client` certificate used on the"},{"line_number":205,"context_line":"    controllers."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_08c3a207","line":202,"range":{"start_line":202,"start_character":25,"end_line":202,"end_character":32},"in_reply_to":"3f79a3b5_54739d1c","updated":"2018-11-09 10:49:48.000000000","message":"Ack","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aec15721a14fa341830e727562514ff09a9148cf","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"    .. code-block:: bash"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"        $ openssl genrsa -aes256 -out private/client.key.pem 2048"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"12. Create the certificate request for the `client` certificate used on the"},{"line_number":205,"context_line":"    controllers."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_54739d1c","line":202,"range":{"start_line":202,"start_character":25,"end_line":202,"end_character":32},"in_reply_to":"3f79a3b5_8c1ba91b","updated":"2018-11-07 17:24:57.000000000","message":"Step 14, the first command, strips that password for use in the combined file.","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c2448f5e14a2fb11364e162e0317f31bcca86c17","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    * You will also be asked to provide details for the certificate. These are"},{"line_number":209,"context_line":"      up to you and should be appropriate for your organization."},{"line_number":210,"context_line":"    * You may want to mention this is the `client` certificate in the common"},{"line_number":211,"context_line":"      name field, or the individual controller information."},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    .. code-block:: bash"},{"line_number":214,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_bb86dd18","line":211,"updated":"2018-12-18 00:41:03.000000000","message":"Maybe we should mention that it is absolutely necessary to fill in the \"common name\" prompt, or it will non-obviously fail, until someone tries to boot an LB, then you\u0027ll see PEM issues.","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"0bcf24c1ee1832ef9a3d1dc0ee8d5253aa0b4955","unresolved":false,"context_lines":[{"line_number":208,"context_line":"    * You will also be asked to provide details for the certificate. These are"},{"line_number":209,"context_line":"      up to you and should be appropriate for your organization."},{"line_number":210,"context_line":"    * You may want to mention this is the `client` certificate in the common"},{"line_number":211,"context_line":"      name field, or the individual controller information."},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    .. code-block:: bash"},{"line_number":214,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_267074a6","line":211,"in_reply_to":"3f79a3b5_bb86dd18","updated":"2018-12-18 01:30:02.000000000","message":"Done","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c2448f5e14a2fb11364e162e0317f31bcca86c17","unresolved":false,"context_lines":[{"line_number":225,"context_line":""},{"line_number":226,"context_line":"        $ openssl ca -config ../openssl.cnf -extensions usr_cert -days 7300 -notext -md sha256 -in csr/client.csr.pem -out certs/client.cert.pem"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"14. Create a concatenated `client` certificate and key file."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    .. code-block:: bash"},{"line_number":231,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_1bf6f12d","line":228,"updated":"2018-12-18 00:41:03.000000000","message":"To be consistent, we should specify here which password this requires (it HOPEFULLY is obvious, but...) so we don\u0027t have any ambiguity.","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"0bcf24c1ee1832ef9a3d1dc0ee8d5253aa0b4955","unresolved":false,"context_lines":[{"line_number":225,"context_line":""},{"line_number":226,"context_line":"        $ openssl ca -config ../openssl.cnf -extensions usr_cert -days 7300 -notext -md sha256 -in csr/client.csr.pem -out certs/client.cert.pem"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"14. Create a concatenated `client` certificate and key file."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    .. code-block:: bash"},{"line_number":231,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_066d38cd","line":228,"in_reply_to":"3f79a3b5_1bf6f12d","updated":"2018-12-18 01:30:02.000000000","message":"Done","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c2448f5e14a2fb11364e162e0317f31bcca86c17","unresolved":false,"context_lines":[{"line_number":230,"context_line":"    .. code-block:: bash"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        $ openssl rsa -in private/client.key.pem -out private/client.cert-key.pem"},{"line_number":233,"context_line":"        $ cat certs/client.cert.pem \u003e\u003e private/client.cert-and-key.pem"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Configuring Octavia"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_db1e390e","line":233,"updated":"2018-12-18 00:41:03.000000000","message":"Here this is not consistent -- this is supposed to be concatenated to the file from the line above it I assume?\nHonestly, I would prefer this was a concatenation of BOTH files, into a new one -- like...\n`cat private/client.cert-key.pem certs/client.cert.pem \u003e private/client.cert-and-key.pem`","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"0bcf24c1ee1832ef9a3d1dc0ee8d5253aa0b4955","unresolved":false,"context_lines":[{"line_number":230,"context_line":"    .. code-block:: bash"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"        $ openssl rsa -in private/client.key.pem -out private/client.cert-key.pem"},{"line_number":233,"context_line":"        $ cat certs/client.cert.pem \u003e\u003e private/client.cert-and-key.pem"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Configuring Octavia"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_4688106b","line":233,"in_reply_to":"3f79a3b5_db1e390e","updated":"2018-12-18 01:30:02.000000000","message":"Done","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c2448f5e14a2fb11364e162e0317f31bcca86c17","unresolved":false,"context_lines":[{"line_number":259,"context_line":"       # chmod 700 /etc/octavia/certs/server_ca.key.pem"},{"line_number":260,"context_line":"       # cp server_ca/certs/ca.cert.pem /etc/octavia/certs/server_ca.cert.pem"},{"line_number":261,"context_line":"       # cp client_ca/certs/ca.cert.pem /etc/octavia/certs/client_ca.cert.pem"},{"line_number":262,"context_line":"       # cp client_ca/private/client.cert-and-key.pem /etc/octavia/certs/client.cert-key.pem"},{"line_number":263,"context_line":"       # chmod 700 /etc/octavia/certs/client.cert-key.pem"},{"line_number":264,"context_line":"       # chown -R octavia.octavia /etc/octavia/certs"},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_9b6a0181","line":262,"updated":"2018-12-18 00:41:03.000000000","message":"This renames the file incorrectly (it is referred to the old name below on L300) and makes instance boots fail if you\u0027re just following this guide via copy/paste.\nEither make sure it\u0027s just using the original name, or change L300 to match the new name. I would vote to keep it the same, not sure why we\u0027d complicate things by renaming stuff.","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"0bcf24c1ee1832ef9a3d1dc0ee8d5253aa0b4955","unresolved":false,"context_lines":[{"line_number":259,"context_line":"       # chmod 700 /etc/octavia/certs/server_ca.key.pem"},{"line_number":260,"context_line":"       # cp server_ca/certs/ca.cert.pem /etc/octavia/certs/server_ca.cert.pem"},{"line_number":261,"context_line":"       # cp client_ca/certs/ca.cert.pem /etc/octavia/certs/client_ca.cert.pem"},{"line_number":262,"context_line":"       # cp client_ca/private/client.cert-and-key.pem /etc/octavia/certs/client.cert-key.pem"},{"line_number":263,"context_line":"       # chmod 700 /etc/octavia/certs/client.cert-key.pem"},{"line_number":264,"context_line":"       # chown -R octavia.octavia /etc/octavia/certs"},{"line_number":265,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_a689e471","line":262,"in_reply_to":"3f79a3b5_9b6a0181","updated":"2018-12-18 01:30:02.000000000","message":"Done","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"}],"doc/source/admin/guides/sample-configs/openssl.cnf":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c2448f5e14a2fb11364e162e0317f31bcca86c17","unresolved":false,"context_lines":[{"line_number":71,"context_line":"localityName_default            \u003d"},{"line_number":72,"context_line":"0.organizationName_default      \u003d OpenStack"},{"line_number":73,"context_line":"organizationalUnitName_default  \u003d Octavia"},{"line_number":74,"context_line":"emailAddress_default            \u003d"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"[ v3_ca ]"},{"line_number":77,"context_line":"# Extensions for a typical CA (`man x509v3_config`)."}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3f79a3b5_3b9bad78","line":74,"updated":"2018-12-18 00:41:03.000000000","message":"Is there a `commonName_default` field? I know it\u0027s something we might want to ensure the users set themselves, but hear me out. Currently the default is blank, which is accepted during the creation of the CSR, but then fails during the signing step -- so if someone is just blindly accepting the defaults, this will actually break in a fairly silent way (there is a warning printed but it\u0027s not super obvious that it did nothing) and cause a PEM error when you try to actually boot a LB later. T_T","commit_id":"585753d8fd2f64404e996d98e9c2c74ce9a02fdc"}]}