step-ca server behind apache

[Szparki]

I recently deployed step-ca, it is configured to listen on *:8443. The server already has apache configured and serving a few websites. I'd like to configure apache to redirect requests for stepca.myserver.com:443 -> 127.0.0.1:8443
I tried a few settings using proxypass, no luck yet. Does anyone have a working example?

[jdoss]

Hey @szpark can you share what you tried and didn't work with Apache's proxypass directives? Anything useful in the logs? You might need to set SSLVerifyClient none or trust your step CA bundle on the server for Apache to trust the CA so it can connect. If you share your config that would be helpful.

[Szparki]

Hey @jdoss, yesterday finally I was able to get a working apache config, I'm sharing it below in case someone else would need it

<IfModule !ssl_module>
	LoadModule ssl_module libexec/apache24/mod_ssl.so
</IfModule>

<IfModule !authnz_ldap_module>
        LoadModule authnz_ldap_module libexec/apache24/mod_authnz_ldap.so
</IfModule>

<IfModule !ldap_module>
	LoadModule ldap_module libexec/apache24/mod_ldap.so
</IfModule>

<IfModule !proxy_module>
	LoadModule proxy_module libexec/apache24/mod_proxy.so
</IfModule>
<IfModule !proxy_html_module>
	LoadModule proxy_html_module libexec/apache24/mod_proxy_html.so
</IfModule>
<IfModule !xml2enc_module>
	LoadModule xml2enc_module libexec/apache24/mod_xml2enc.so
</IfModule>
<IfModule !proxy_http_module>
	LoadModule proxy_http_module libexec/apache24/mod_proxy_http.so
</IfModule>

<VirtualHost stepca.myserver.com:443>

	SSLProxyEngine		on
	SSLProxyVerify		none
	SSLProxyCheckPeerCN	off
	SSLProxyCheckPeerName	off

	SSLEngine		on

	SSLCertificateFile      "/usr/local/etc/ssl/stepca.myserver.com.crt"
	SSLCertificateKeyFile   "/usr/local/etc/ssl/stepca.myserver.com.key"

	ServerName  stepca.myserver.com
	ErrorLog    "/var/log/apache/stepca.myserver.com-error.log"
	TransferLog "/var/log/apache/stepca.myserver.com-access.log"

	ProxyPass "/health/" "https://127.0.0.1:8443/health/"
	ProxyPassReverse "/health/" "https://127.0.0.1:8443/health/"

	ProxyPass        / https://127.0.0.1:8443/
	ProxyPassReverse / https://127.0.0.1:8443/

	<Location />
		Require all granted
	</Location>

</VirtualHost>

Where /usr/local/etc/ssl/stepca.myserver.com.crt has the certificate for stepca.myserver.com.crt domain plus the step-ca intermediate cert

[Szparki]

Unfortunately it looks above apache is not working for certificate renewals :-(

I get the following error on the client server side when I try to renew a certificate:

step ca renew client.server.com.crt client.server.com.key --ca-url $CAURL --root $ROOTCA
error renewing certificate: The request could not be completed: missing client certificate.

And this error on the step-ca server side:

step_ca[1792]: time="2022-07-08T07:57:08Z" level=warning duration="91.632µs" duration-ns=91632 error="missing client certificate" fields.time="2022-07-08T07:57:08Z" method=POST name=ca path=/renew protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=cb3u6l7amgj0ep20k7lg size=91 status=400 user-agent=Go-http-client/1.1 user-id=

If I connect directy to :8443 there are no errors

[hslatman]

Hey @szpark, certificate renewal is authenticated by mTLS and thus requires the client certificate to be present in the TLS connection to step-ca. If Apache terminates TLS, the client certificate is not present in the connection to step-ca. Usually, you'll want a proxy to do Layer 4 proxying for you instead, so that step-ca can terminate TLS itself. I'm not sure if Apache supports Layer 4 (TCP) proxying.

There is a workaround if you're using the step CLI. It involves renewing the certificate after it has expired. This is off by default and needs to be configured on the CA with the allowRenewalAfterExpiry setting. The CLI will create a token to authenticate instead of using mTLS. Allowing this results in the CA accepting expired certificates, which may not be what you want, though.

[maraino]

There's an alternative though, although currently, this is not straightforward (we should add a flag to step ca renew) to do it.

But given a certificate internal.crt and internal.key with the common name internal.smallstep.com, we can generate a token and send it to the /1.0/renew endpoint to get a new certificate:

$ curl -X POST -H "Authorization: Bearer $(step ca token --renew --x5c-cert internal.crt --x5c-key internal.key internal.smallstep.com)" https://ca.smallstep.com:9000/1.0/renew
{"crt":"-----BEGIN CERTIFICATE-----\nMII...\n-----END CERTIFICATE-----\n","ca":"-----BEGIN CERTIFICATE-----\nMII...\n-----END CERTIFICATE-----\n","certChain":["-----BEGIN CERTIFICATE-----\nMII...\n-----END CERTIFICATE-----\n"],"tlsOptions":{"cipherSuites":["TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"],"minVersion":1.2,"maxVersion":1.3,"renegotiation":false}}

You can combine that with jq and some scripting to get the renewed certificate :)

But we really should add a flag to step ca renew

[maraino]

Issue added https://github.com/smallstep/certificates/issues/976