{"id":139,"date":"2022-06-25T20:30:06","date_gmt":"2022-06-26T01:30:06","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=139"},"modified":"2022-10-28T13:22:05","modified_gmt":"2022-10-28T18:22:05","slug":"add-ssl-certificate-to-aviatrix-controller","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=139","title":{"rendered":"Add SSL Certificate to Aviatrix Controller"},"content":{"rendered":"\n

When first launched Aviatrix controller from marketplace, the Aviatrix controller give itself a self-signed certificate, and you have to use https:\/\/controller-ip to access it, which may not meet compliance requirement.<\/p>\n\n\n\n

This blog will talk about getting a public trusted SSL certificate for Aviatrix controller.<\/p>\n\n\n\n\n\n\n\n

First you will need to own a domain name, there are many domain registrar<\/a><\/em> such as NamesCheap<\/em><\/a> that you pay yearly, or Freenom<\/a><\/em> for free with limited Top Level Domain (TLD) names.<\/p>\n\n\n\n

Let’s say you have obtained your domain name: mydomain.com, and you have decided that to access your controller you would use https:\/\/avx.mydomain.com<\/strong><\/p>\n\n\n\n

Create an A record in DNS provider, so avx.mydomain.com<\/strong> would point to the Aviatrix Controller public IP.<\/p>\n\n\n\n

There are free SSL certificate provider such as LetsEncrypt<\/em> or ZeroSSL<\/a><\/em>, in this blog, I’m using ZeroSSL to request a certificate for avx.mydomain.com<\/strong>, as it allows you request certificate directly from Web Page rather than using CertBot <\/a><\/em>command line. <\/p>\n\n\n\n

NEW<\/strong>! ZeroSSL limits total of three 90 days certificate, expired certificate also counts towards the total. If you need to get certificate frequently, follow this blog to get a free SSL certificate: Get a free public SSL certificate for testing environment using Posh-ACME<\/a><\/p>\n\n\n\n

After you created an account in ZeroSSL, choose New Certificate<\/strong><\/p>\n\n\n\n

Enter Domains : avx.mydomain.com<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I’ve picked 90-Day Certificate (Free)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Leaving default to Auto-Generate CSR (Certificate Signing Request)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Stay with Free offer<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next step is to validate that you actually own the domain, if you just setup DNS, you may not have email or web page yet, so I’ve picked DNS (CNAME) validation. But you are welcome to use email provider such as zoho<\/em> to setup mailbox (will require MX record for email), or create a webpage for file upload (Will require A record for your website)<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Goes back to your DNS provider and create the CNAME. DNS can be slow to propagate, after this I would suggest to wait for half an hour, before try Verify Domain<\/strong> button.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once the domain is validated, and the certificate will be issued. You can choose to download the certificate zip file.<\/p>\n\n\n\n

The zip file contains three files:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

ca_bundle.crt<\/strong>: This file contains only one intermediate certificate<\/span> (ZeroSSL CA). <\/p>\n\n\n\n

certificate.crt<\/strong>: This file contains your primary SSL certificate<\/p>\n\n\n\n

private.key<\/strong>: This file contains your private key<\/p>\n\n\n\n

\n\n\n\n
Note: <\/h6>\n\n\n\n

ca_bundle.crt<\/strong> and certificate.crt<\/strong> are PEM encoded X.509 certificate<\/em><\/strong>, when opens up using text editor, it looks like:<\/p>\n\n\n\n

-----BEGIN CERTIFICATE-----\nMIIGhz...\n...\n...WlLw==\n-----END CERTIFICATE-----<\/code><\/pre>\n\n\n\n
private.key<\/strong> is PEM encoded RSA private key<\/em><\/strong>, when opens up using text editor, it looks like:<\/p>\n\n\n\n
-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n...\n...\n-----END RSA PRIVATE KEY-----<\/code><\/pre>\n\n\n\n
This article<\/a> is a great read of different type of certificates.<\/p>\n\n\n\n
\n\n\n\n
Note<\/strong>: If you are planning to use Azure Application Gateway to front end your controller, you will need to obtain full chain cert<\/a><\/em>. Otherwise Application Gateway would complain cannot validate root certificate.<\/p>\n\n\n\n
The root certificate of the server certificate used by the backend does not match the trusted root certificate added to the application gateway. Ensure that you add the correct root certificate to whitelist the backend<\/code><\/pre>\n\n\n\n
To obtain full chain cert:<\/p>\n\n\n\n
On MacOS or Linux:<\/p>\n\n\n\n
cat certificate.crt ca_bundle.crt > full_chain.crt<\/code><\/pre>\n\n\n\n
On Windows:<\/p>\n\n\n\n
copy \/b certificate.crt + ca_bundle.crt full_chain.crt<\/code><\/pre>\n\n\n\n
\n\n\n\n
Login to Aviatrix Controller, Settings -> Security<\/p>\n\n\n\n