Bug 53837 – Improve documentation of Kelvin REST API regarding vhosts and SSL certificates

Bug 53837 - Improve documentation of Kelvin REST API regarding vhosts and SSL certificates


Summary:	Improve documentation of Kelvin REST API regarding vhosts and SSL certificates

Status:	NEW

Product:	UCS@school
Classification:	Unclassified
Component:	HTTP-API (Kelvin)
Version:	UCS@school 5.0
Hardware:	Other Linux

Importance:	P5 normal with 1 vote (vote)
Target Milestone:	---
Assigned To:	UCS@school maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2021-09-24 16:13 CEST by Daniel Tröder
Modified:	2021-09-24 16:19 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Tröder

2021-09-24 16:13:15 CEST

The Kelvin REST API automatically connects to the FQDN found in UCRV "ldap/master" ("primary.ucs.local").

While it has a configuration option for using a custom SSL certificate, if a customer got a certificate signed by a public CA, that certificate will most likely not include the name UCS servers name in "ldap/master" but only the name intended for the public ("portal.school.de").

The solution to the problem is to create separate vhosts for the name in "ldap/master" ("primary.ucs.local") and the servers public name ("portal.school.de"):

univention-add-vhost --ssl --cert /etc/univention/ssl/primary.ucs.local/cert.pem --private-key /etc/univention/ssl/primary.ucs.local/private.key --ca /etc/univention/ssl/ucsCA/CAcert.pem primary.ucs.local 443

Add a section about with this command to the Kelvin REST APIs documentation.