KafkaUser: Use both tls and tls-external authentication types (Strimzi 0.25)

[opsocomusr]

Can we use both tls and tls-external authentication types in Strimzi 0.25?

After adding the external ca to the secret, the internal users (auth type tls) reconciliation/new user addition with auth type tls started to fail with the below error in the logs.

Note: I have both the CAs (strimzi generated and external) available in the secret.

2021-08-16 12:07:04 DEBUG Ca:282 - Reconciliation #8(watch) KafkaUser(strimzi/internal-user): Generating certificate Subject(organizationName='null', commonName='internal-user', dnsNames=[], ipAddresses=[]) with SAN {}, signed by CA clients-ca
2021-08-16 12:07:04 DEBUG OpenSslCertManager:583 - Running command [openssl, req, -new, -batch, -nodes, -keyout, /tmp/tls1370562182463860822key, -out, /tmp/tls3977486109183364144csr, -subj, /CN=internal-user]
2021-08-16 12:07:04 DEBUG OpenSslCertManager:606 - Got result 0
2021-08-16 12:07:04 DEBUG OpenSslCertManager:583 - Running command [openssl, ca, -utf8, -batch, -notext, -in, /tmp/tls3977486109183364144csr, -out, /tmp/tls8756511201575124793cert, -cert, /tmp/5683806244613345642.tmp, -keyfile, /tmp/10758306778323693707.tmp, -startdate, 20210816120704Z, -enddate, 20220816120704Z, -config, /tmp/16860036574783747357.tmp]
2021-08-16 12:07:04 DEBUG OpenSslCertManager:606 - Got result 1
2021-08-16 12:07:04 DEBUG OpenSslCertManager:95 - File not deleted, because it did not exist: /tmp/5683806244613345642.srl
2021-08-16 12:07:04 DEBUG OpenSslCertManager:583 - Running command [openssl, pkcs12, -export, -in, /tmp/tls8756511201575124793cert, -inkey, /tmp/tls1370562182463860822key, -name, internal-user, -out, /tmp/tls5808517118677691964p12, -passout, pass:Y9pKGSQH4tmi]
2021-08-16 12:07:04 ERROR OpenSslCertManager:599 - Got result 1 with output
unable to load certificates

2021-08-16 12:07:04 ERROR AbstractOperator:240 - Reconciliation #8(watch) KafkaUser(strimzi/internal-user): createOrUpdate failed
java.lang.RuntimeException: openssl status code 1
	at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:601) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0]
	at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:559) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0]
	at io.strimzi.certs.OpenSslCertManager.addKeyAndCertToKeyStore(OpenSslCertManager.java:356) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0]
	at io.strimzi.operator.cluster.model.Ca.generateSignedCert(Ca.java:289) ~[io.strimzi.operator-common-0.25.0.jar:0.25.0]
	at io.strimzi.operator.cluster.model.Ca.generateSignedCert(Ca.java:332) ~[io.strimzi.operator-common-0.25.0.jar:0.25.0]
	at io.strimzi.operator.cluster.model.Ca.generateSignedCert(Ca.java:307) ~[io.strimzi.operator-common-0.25.0.jar:0.25.0]
	at io.strimzi.operator.user.model.KafkaUserModel.maybeGenerateCertificates(KafkaUserModel.java:262) ~[io.strimzi.user-operator-0.25.0.jar:0.25.0]
	at io.strimzi.operator.user.operator.KafkaUserOperator.lambda$maybeGenerateTlsCredentials$6(KafkaUserOperator.java:214) ~[io.strimzi.user-operator-0.25.0.jar:0.25.0]

[scholzj]

The clients CA is supposed to contain only one CA. So I'm not sure how you did it to have 2 CAs in the secrets, but most probably that is breaking it?

In general, you can use both tls and tls-external together. But s said above, it expects the same CA to be used. So it makes little sense to use them together.

[maticue]

Hi @scholzj , is there any plan to add multiple CA support? I have same requirement than @Pradeep2103. I want to keep using strimzi self-signed ca for internal users, but also provide the ability of trusting other CAs (like Let's encrypt).

[scholzj]

I do not think Let's Encrypt & Co are suitable or user authentication => They are designed for a completely different purpose and that are server certificates. You cannot use Let's Encrypt for user certificates because you would basically authenticate anyone with Let's Encrypt certificate as a client.

[maticue]

Understood, I was thinking managing access with ACLs. Anyway, Let's Encrypt is just an example. What I wanted to avoid is me sharing cert and private key for other users. I wanted they create their own private key and I just choose to trust or not on their CA.

[scholzj]

Well, you could let anyone log in and then use the ACLs. But that is definitely a super bad practice. Would you let anyone SSH into your server or workstation and rely only on system permissions that they cannot do anything bad?

In general, I think you either let Strimzi manage the user certs. Or you have to manage it your-self. And when you invest the effort and manage your own CA, then why not use it for all certificates? Keep in mind that you cannot really let your users manage the CA - that would leave even in worse situation than with Let's Encrypt since the users will be able to issue any certificates for themselves with any subject and will be able to easily impersonate any users in your system and easily bypass the ACLs. So you would need to run the CA and the users will send you the CSRs for signing with the CA and then connect => that is IMHO the only secure option.

[maticue]

Thank you @scholzj !