<div dir="ltr">Hi P.K.<div><br></div><div>I tried the same thing. </div><div><br></div><div>Could you share which url you tested?</div><div>With that change, if I access the https://${bmc}/redfish/v1 url in chrome, it prompts to choose a client certificate, but will also work if no certificate is chosen.</div><div><br>Thanks,</div><div>Zhenfei</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 30, 2020 at 6:27 AM P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I found a way to fix this issue, but it needs to be modified to the source code. In two steps:<br>
<br>
Step 1.<br>
The source code "adaptor.set_verify_mode(boost::asio::ssl::verify_peer);" in http_connection.h is replaced with <br>
"adaptor.set_verify_mode(boost::asio::ssl::verify_peer | boost::asio::ssl::verify_fail_if_no_peer_cert);"<br>
<br>
Step 2.<br>
AccountService->Oem->OpenBMC->AuthMethods->TLS is set. (false by default)<br>
<br>
It will enable enforce mTLS authentication.<br>
<br>
Best,<br>
P.K.<br>
<br>
> -----Original Message-----<br>
> From: Wiktor Gołgowski <<a href="mailto:wiktor.golgowski@linux.intel.com" target="_blank">wiktor.golgowski@linux.intel.com</a>><br>
> Sent: Saturday, April 25, 2020 1:03 AM<br>
> To: Richard Hanley <<a href="mailto:rhanley@google.com" target="_blank">rhanley@google.com</a>>; Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>><br>
> Cc: <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>; P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>>;<br>
> <a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>; P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>>; Joseph<br>
> Reynolds <<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>><br>
> Subject: Re: mTLS on bmcweb<br>
> <br>
> <br>
> <br>
> On 4/23/20 7:35 PM, Richard Hanley wrote:<br>
> > My guess is that somehow the root cert used to validate clients isn't installed<br>
> correctly, and so it's defaulting to basic auth.<br>
> ><br>
> > At least that's my reading of this review<br>
> > <a href="https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27270" rel="noreferrer" target="_blank">https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27270</a><br>
> ><br>
> <br>
> I think this would be the case. If the client certificate is not provided, TLS<br>
> connection is still established, just without authenticating the client. This<br>
> allows upper layer to provide other authentication methods (e.g. Basic Auth).<br>
> ><br>
> > On Thu, Apr 23, 2020 at 9:47 AM Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a><br>
> <mailto:<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>>> wrote:<br>
> ><br>
> > I guess part of my question is how to configure the mTLS certs to make<br>
> it work properly.<br>
> ><br>
> > So far only https works (server side TLS).<br>
> ><br>
> > Thanks,<br>
> > Zhenfei<br>
> ><br>
> > On Thu, Apr 23, 2020 at 8:50 AM Joseph Reynolds <<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a><br>
> <mailto:<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>>> wrote:<br>
> ><br>
> > On 4/23/20 5:47 AM, P. K. Lee (李柏寬) wrote:<br>
> > > Hi,<br>
> > ><br>
> > > I encountered the same issue when using Redfish to replace the<br>
> certificate.<br>
> > > Regardless of whether the parameters include --cert --key<br>
> --cacert or only --cacert, the authentication can still succeed.<br>
> > ><br>
> > > Best,<br>
> > > P.K.<br>
> > ><br>
> > >> Date: Wed, 22 Apr 2020 14:58:06 -0700<br>
> > >> From: Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a><br>
> <mailto:<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>>><br>
> > >> To: <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a><br>
> <mailto:<a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>><br>
> > >> Subject: mTLS on bmcweb<br>
> > >> Message-ID:<br>
> ><br>
> >> <CAMXw96Pp511sUO=q1XLz2uJzh4S6D7tUwmkvpbnq_yU-iJfiKg@<br>
> mail.g<br>
> > >> <a href="http://mail.com" rel="noreferrer" target="_blank">mail.com</a> <<a href="http://mail.com" rel="noreferrer" target="_blank">http://mail.com</a>>><br>
> > >> Content-Type: text/plain; charset="utf-8"<br>
> > >><br>
> > >> Hi,<br>
> > >><br>
> > >> I'm trying out bmcweb mTLS which should be enabled by<br>
> default by<br>
> > >><br>
> <a href="https://github.com/openbmc/bmcweb/blob/master/CMakeLists.txt#L89" rel="noreferrer" target="_blank">https://github.com/openbmc/bmcweb/blob/master/CMakeLists.txt#L89</a><br>
> > >><br>
> > >> In my test, I created a self signed key and certificate pair,<br>
> stacked them<br>
> > >> up into server.pem in /etc/ssl/certs/https that bmcweb uses.<br>
> > >><br>
> > >> However when I tried to curl bmcweb service, I was able to get<br>
> response by<br>
> > >> only supplying the cert.<br>
> > >><br>
> > >> curl --cacert cert.pem https://${bmc}/redfish/v1<br>
> > >><br>
> > >> With the mTLS enabled, I expected it should error out since no<br>
> client<br>
> > >> certificate is provided.<br>
> > >><br>
> <br>
> As mentioned, if you did not provide a client certificate, connection was<br>
> established to allow for Basic Auth. And as the Service Root requires no<br>
> authentication, you got a response.<br>
> <br>
> - Wiktor<br>
> <br>
> > >> Could someone with relevant knowledge help with my<br>
> question?<br>
> ><br>
> > I'm not sure what you are asking. Are you asking how to install<br>
> mTLS<br>
> > certs into the BMC and then use them to connect? I am still<br>
> waiting for<br>
> > documentation that describes how to configure and use the mTLS<br>
> feature.<br>
> ><br>
> > I've added an entry to the security working group as a reminder to<br>
> do<br>
> > this. (I don't have the skill to document this feature.)<br>
> ><br>
> > - Joseph<br>
> ><br>
> > >><br>
> > >> Thanks,<br>
> > >> Zhenfei<br>
> ><br>
</blockquote></div>