History

Veraghin 169b170835 Update GNUmakefile Cert auth generation echo fixed		2019-09-17 22:05:53 +01:00
..
GNUmakefile	Update GNUmakefile	2019-09-17 22:05:53 +01:00
README.md	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
ca-csr.json	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
ca-key.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
ca.csr	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
ca.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
cfssl-user.json	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
cfssl.json	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
client-key.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
client.csr	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
client.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
csr.json	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
dev-key.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
dev.csr	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
dev.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
server-key.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
server.csr	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
server.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
tls-client.hcl	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
tls-dev.hcl	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
tls-server.hcl	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
user-key.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
user.csr	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
user.pem	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00
user.pfx	Add demo TLS certificates and configs	2018-01-09 10:14:42 -08:00

README.md

Demo TLS Configuration

Do NOT use in production. For testing purposes only.

See Securing Nomad for a full guide.

This directory contains sample TLS certificates and configuration to ease testing of TLS related features. There is a makefile to generate certificates, and pre-generated are available for use.

Files

Generated?	File	Description
◻️	`GNUmakefile`	Makefile to generate certificates
◻️	`tls-*.hcl`	Nomad TLS configurations
◻️	`cfssl*.json`	cfssl configuration files
◻️	`csr*.json`	cfssl certificate generation configurations
☑️	`ca*.pem`	Certificate Authority certificate and key
☑️	`client*.pem`	Nomad client node certificate and key
☑️	`dev*.pem`	Nomad certificate and key for dev agents
☑️	`server*.pem`	Nomad server certificate and key
☑️	`user*.pem`	Nomad user (CLI) certificate and key
☑️	`user.pfx`	Nomad browser PKCS #12 certificate and key (blank password)

Usage

Agent

To run a TLS-enabled Nomad agent include the tls.hcl configuration file with either the -dev flag or your own configuration file. If you're not running the nomad agent command from this directory you will have to edit the paths in tls.hcl.

# Run the dev agent with TLS enabled
nomad agent -dev -config=tls-dev.hcl

# Run a *server* agent with your configuration and TLS enabled
nomad agent -config=path/to/custom.hcl -config=tls-server.hcl

# Run a *client* agent with your configuration and TLS enabled
nomad agent -config=path/to/custom.hcl -config=tls-client.hcl

Browser

To access the Nomad Web UI when TLS is enabled you will need to import two certificate files into your browser:

ca.pem must be imported as a Certificate Authority
user.pfx must be imported as a Client certificate. The password is blank.

When you access the UI via https://localhost:4646/ you will be prompted to select the user certificate you imported.