Authentication Using Client Certificates, Part 2

Enable Client Certificates With the CLI or REST API

./couchbase-cli ssl-manage -c <IP-node1> -u username -p password --set-client-auth settings.json 

Use the above code where settings.json contains a JSON object with the state set to either enabled or mandatory and has a triple prefix as described in the previous article. The prefix is an array of these fields. Using the examples in Part 1 of this article, the following is how settings.json might look: 

xxxxxxxxxx

{

  "state": "enable",

  "prefixes": [

    {

      "path": "subject.cni",

      "prefix": "www.",

      "delimiter": "."

    },

    {

      "path": "san.dnsnamel",

      "prefix": "node1.",

      "delimiter": "."

    }

  ]

}

We can also use the REST API to do the same. 

xxxxxxxxxx

curl  -XPOST <IP-node1>:8091/settings/clientCertAuth --data-binary @client-auth-settings.json -u username:password

Configuring the Client Certificates Using Root Authorization

These steps are pretty similar to how we setup the certificates in another DZone article: https://dzone.com/articles/authentication-using-server-side-x509-certificates 

We first need to create a private key using OpenSSL:

openssl genrsa -out client.key 2048 2>/dev/null 

Next, we need to create a certificate signing request (CSR). A CSR is a request sent from an applicant to a CA to apply for a certificate. You can customize it by adding to or limiting the capabilities of the X.509 certificate using an extension file:

xxxxxxxxxx

openssl req -new -key client.key -out client.csr -subj '/C=US/O=Couchbase/CN=Clientauthuser' 2>/dev/null

xxxxxxxxxx

cat > v3.ext <<EOF

basicConstraints = CA:FALSE

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid,issuer:always

EOF

For an extensive list of all the standard extensions, see section 4.2 of RFC 5280 on the X509 PKI and CRL profile - https://tools.ietf.org/html/rfc5280. 

Now we need to generate the client certificate:

xxxxxxxxxx

openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial  -extfile v3.ext -out client.pem -days 365 2>/dev/null 

Here ca.pem and ca.key represent the root certificate's private and public keys as generated here (while setting up the X509 server certificates).

Use the certificate to authenticate client requests. 

For more information or details on configuring client certificates for multiple clients and using the intermediate certificate to configure your client certificate visit Couchbase's docs - Managing Certificates.