Creating P12 certificates in a github workflow

Elastic Stack Elasticsearch
1

Hi, we would like to implement a rotation of P12-certificates using github workflows.

Let's say you have a CA certificate. Would it be possible, in a github workflow, to use a public Elasticsearch docker image to create password signed P12 certificates?

The CA certificate will be fetched from Azure Key Vault and mounted to a folder on a private github runner. Then the CA will be mounted to a folder on the docker container to be used to create P12 certificates. Is it possible? And how would that docker command look like?

2

Hi @tdvo1996,

Just to check - where does Elasticsearch stand in the question? Only to create certificates?

3

Yes, it's for configuring elastic with xpack security. I'm trying to automate configuring elastic as much as possible. For example using github workflows and ansible to rotate certificates.

4

I see, I've moved this topic into Elastic Stack - Elasticsearch section so that you can get more visibility on your question from Elasticsearch team.

5

I tried posting on elastic stack first, but I wasn't able to do it. The "New Topic"-button was greyed out, but thanks!

6

Not if all you have is a CA certificate. You need a copy of the CA private key in order to be able to issue new certificates.

7

Ah, I see. What if you have a ca in the form of a p12 certificate, and then spin up a n elastic docker image to run this command:

./elasticsearch-certutil cert --ca /etc/elasticsearch/cert/p12/elastic-stack-ca.p12 --in /usr/share/elasticsearch/bin/instances.yml --out certs.zip?

Something like this:

 docker run --rm \
            -v ./certs:/usr/share/elasticsearch/config/certs \
            -v ${{ inputs.instances_file_path }}/instances.yml:/usr/share/elasticsearch/config/instances.yml \
            docker.elastic.co/elasticsearch/elasticsearch:8.11.2 \
            elasticsearch-certutil cert --ca /usr/share/elasticsearch/config/certs/elastic-stack-ca.p12 \
            --in /usr/share/elasticsearch/config/instances.yml \
            --out /usr/share/elasticsearch/config/certs/certs.zip -ca-pass "$pwd" --pass "$pwd"

I'm fairly new to configuring elastic, so correct me if I say anything incorrect.

8

Hm, let's say I have everything I need to create P12 certificates. Is it possible to rotate P12 certificates with github actions?

9

Not sure how this related to any tool in the stack.

How you create or update the certificates used doesn't matter, you just need to make sure that the configuration is pointing to the correct certificates, but how you do that on Github Action is unrelated to Elasticsearch.

You also do not need to use elasticsearch-certutil to create any certificates, you can for example use openssl to create it.

I have a compose that spin-ups a local SIEM using Elastic + Kibana + Fleet for some testing and I use the following to create the certificates in PEM format.

  certs:
    image: ubuntu:24.04
    container_name: certs
    volumes:
      - ./certs:/usr/share/certs:z
    command: >
      bash -c '
        cd /usr/share/certs;
        if [ -f certs.exist ]; then
          echo "certificados já criados"
          exit 0;
        fi;
        apt update && apt install -y openssl;
        # ca
        openssl genrsa -out ca-siem-key.pem 2048
        openssl req -new -x509 -sha256 -key ca-siem-key.pem -subj "/C=BR/ST=RJ/L=RIO DE JANEIRO/O=LAB/OU=SIEM" -out ca-siem.pem -days 1830
        # elasticsearch + kibana + fleet
        openssl genrsa -out siem-key.tmp 2048
        openssl pkcs8 -inform PEM -outform PEM -in siem-key.tmp -topk8 -nocrypt -v1 PBE-SHA1-3DES -out siem-key.pem
        openssl req -new -key siem-key.pem -subj "/C=BR/ST=RJ/L=RIO DE JANEIRO/O=LAB/CN=SIEM" -out siem.csr
        echo "subjectAltName=DNS:elasticsearch, DNS:kibana, DNS:fleet, DNS:localhost" > siem.ext
        openssl x509 -req -in siem.csr -CA ca-siem.pem -CAkey ca-siem-key.pem -CAcreateserial -sha256 -out siem.pem -days 1830 -extfile siem.ext
        chmod 640 *.pem
        rm -f *.ext
        rm -f *.tmp
        rm -f *.csr
        rm -f *.srl
        touch certs.exist
      '
    networks:
      - siem
1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.