Thank you, Guangrong, You are correct, AAF includes a CertificateManager. The main intention is to be a Registration Authority for Certificates, which means that it ensures certificates are generated only to Authorized Organizational entities, using official Organization Identifiers, etc. For ONAP Test, or for small entities that do not or need to deal with more complex Certificate Authority software, we include the ability to utilize CA Certificates built by openssl command line software. The second part is to generate these into a form easily consumable by the software in question, to a targeted spot.
Can you give me a link or two about “Holmes”? I am not familiar with that, and an internet search turns up a variety of things, even beyond the obvious Sherlock Holmes books, movies and fan clubs… 😉. For instance, apparently, the UK has software for their police appropriately named “Holmes”, and I also found links to a Spanish Linux variety, for which I don’t understand the connection… 😉 The main thing we need to know is what your target consumable software is. Java, for instance, requires JKS or PKCS12 keystores. Core Linux platforms usually prefers certs in their “raw” PEM file format. The second is your target persistence. Are you utilizing Raw O/S, or using Docker/K8. CertificateManager can generate to Docker Volumes (which can be utilized by K8 as well), or you can generate to disk. Therefore, what is your target runtime, O/S (UNIX), Docker or K8? As you can see in this short email, there are a lot of possibilities, and much of my short time in ONAP has been in learning the desired target states, creating the concept of Organization, Creating a Certificate strategy etc. Thus, thank you for your patience as we work on documenting these more clearly in Dublin. -- Jonathan Gathman Principled-System Architect ATO Tech Dev/SEAT/Platform Architecture and Technology Management AT&T Services, Inc. 2349 Oaker, Arnold, MO 63010 m 314-550-3312 | [email protected]<mailto:[email protected]> From: Guangrong Fu <[email protected]> Date: Thursday, January 3, 2019 at 12:57 AM To: "GATHMAN, JONATHAN C" <[email protected]> Cc: onap-discuss <[email protected]> Subject: [aaf] About Certificate Management for HTTPS requests Hi Jonathan, First of all, I wish you a Happy New Year! I remember that someone's told me that AAF could issue and manage the certificate for other components. I wonder if we could get a certificate for Holmes by integrating it with AAF. For now, the cert file for Holmes is self-signed. I think we could improve it a little in the coming release. So if AAF is capable of doing so, would you please point me to some wiki page on how to implement this? I've been reading documents under the AAF project but there are some many pages so that I sort of got lost. Thanks in advance. Guangrong -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#14775): https://lists.onap.org/g/onap-discuss/message/14775 Mute This Topic: https://lists.onap.org/mt/28923439/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
