I think this is in the http.client module?

Description

Hello mTLS for Kafka requires the use of OpenSSL to create PKCS#12 certificates. But now step has now support for this kind of certificates using step certificate p12 command, see smallstep/cli#372.

We can now change kafka docs to use step instead of OpenSSL.

https://docs.confluent.io/current/kafka/authentication_ssl.html

Not just URLs

I'd like to see documentation for Schema Registry.

This software can:

• Accept TLS connections
• Authenticate clients with TLS
• Request TLS connections with client certificates

This may not be one docs directory for both, but instead mysql and mysql-client directories.

Hi,

The resources linked from the website for all the examples currently seem to be missing.

$ http -h HEAD https://smallstep.com/hello-mtls/doc/server/express | head -n1
HTTP/1.1 404 Not Found

User is looking to implement TLS on RabbitMQ.

Found this:
https://www.rabbitmq.com/ssl.html

Using Net::HTTP

@sourishkrout An item for discussion I noticed after reviewing the golang doc.

Should we standardize the server port number across all docs? For example, the nginx doc suggests binding :443, and the curl doc connects over bare domain (:443). But, go binds to :9443 and the client requests from :9443.

So, if in the process of going through a tutorial or onboarding flow, someone selects nginx as the server and go as the client, they'll be told to listen on :443 but make a request to the server at :9443. Or if they do go server and curl client, it's the opposite.

Any ideas? Seems like :9443 could work across the board without needing superuser privileges, but it's pretty awkward to configure nginx or some other thing that's obviously a web server on that port.

Or maybe we somehow provide a way (maybe in config.yaml) for docs that offer servers to also specify the port they bind to, then use a {{ port }} variable in client docs to feed in the port from the configured server?

This may not be one docs directory for both, but instead postgres and psql directories.

https://www.postgresql.org/docs/10/auth-methods.html#AUTH-CERT
https://www.postgresql.org/docs/9.5/ssl-tcp.html
https://serverfault.com/a/811706

https://github.com/smallstep/hello-mtls/network/alerts

I'm not actually sure if Rails can terminate TLS or do client auth? Tutorials often point to authenticating at Nginx or Apache.

This could probably be split into multiple issues. I'm not sure what the options are here.

https://cwiki.apache.org/confluence/display/ZOOKEEPER/ZooKeeper+SSL+User+Guide
https://juplo.de/encrypt-communication-between-kafka-and-zookeeper-with-tls/

This could be split into multiples. Not sure what popular options are... Laravel, Symfony, ??? Or maybe TLS just terminates at the Apache/nginx web server for PHP, not sure whether they encourage running your own pure PHP server and reverse proxying these days.

@sourishkrout, this is in reference to this comment:

https://github.com/smallstep/hello-mtls/pull/23/files#r326783119

Thoughts?

I'd like to see documentation for TiDB.

I'd like to see documentation for Mosquitto.

This software can:

• [X ] Accept TLS connections
• [X ] Authenticate clients with TLS
• [ X] Request TLS connections with client certificates

MySQL actually supports this with the SUBJECT clause:

https://dev.mysql.com/doc/refman/8.0/en/create-user.html#create-user-tls

I'd like to see documentation for Prometheus.

If I remember correctly, they use a third party lib as their trust store, so it could be a little tricky.

This one can make mention of Express too, but options/config should be roughly the same as raw https.

There's lots of tech used to make transforms on Kafka data. These could be split into other issues.

I'd like to see documentation for MongoDB.

I'm clueless here as to what the broadest tech is, so this should be split into other issues for clients and servers (Spring, Struts, ???).

Relatedly, we could probably break out issues for Scala and friends.

https://smallstep.com/hello-mtls/doc/server/nginx

In this example ssl_client_certificate contains only root certificate without intermediate certs.
This way server wouldn't be able to check client certs coming from browser (browser sends leaf cert only, not the whole bundle)

Server needs to have intermediates too in its ssl_client_certificate file.

This may not be one docs directory for both, but instead redis and redis-cli directories.

Add README content for importing docs, rendering with the ContentBlock component, and enabling syntax highlighting.

Hi All,

Is it possible to do mTLS between Step-CA and a MariaDB Database Backend, or only "one-way" TLS from Step-CA to the MariaDB Backend?

If it is possible, did I simply miss the documentation on this (& could someone please point me in the right direction)? 😄

Please note that I am not asking about Step-CA facilitating mTLS between a MariaDB Database and another 3^rd-Party application (I know how to do that, and have done so within our existing PKI), but between Step-CA itself and a MariaDB Database.

Thanks in advance

Dulux-Oz

You can give Fastly a cert for client auth with your origin. I'm not sure if you can supply your own CA cert to their trust store, though, for auth-ing the origin?

This will make the markdown more portable than relying on lodash templates.

We currently don't show content on renewals, but when we do (a large project), we should add an ACME renewal flow for Traefik:

Traefik is a modern reverse-proxy with integrated support for ACME. It's easy to get a certificate from Let's Encrypt andy other ACME compatible CAs like step-ca in Traefik, using the tls-alpn-01 ACME challenge type.

Most importantly, Traefik will need to trust your root CA certificate. Either use the LEGO_CA_CERTIFICATES environment variable to provide the full path to your {{ ca_cert }} when running Traefik, or install your root certificate in your system's trust store.

In your Traefik static configuration, you'll need to add a certificatesResolvers block:

[certificatesResolvers]
  [certificatesResolvers.myresolver]
    [certificatesResolvers.myresolver.acme]
      caServer = "https://step-ca.internal/acme/acme/directory"
      email = "[email protected]"
      storage = "acme.json"
      tlsChallenge = true

Then, when you add routers to your dynamic configuration for HTTPS traffic, you need to set tls and tls.certResolver:

## Dynamic configuration
[http]
  [http.routers]
    [http.routers.router1]
      ...
      [http.routers.router1.tls]
        certResolver = "myresolver"

cc @tashian

Either by linking to a blog post/docs generally, adding links per technology, or adding the ciphers directly to code snippets.

It may actually support chained certs (and hopefully even ECDSA???) unlike MySQL.