Re-adding the libvirt-users list - please don't take discussions off-list. On Mon, Dec 10, 2018 at 01:10:18PM +0300, Anastasiya Ruzhanskaya wrote: > I already found out how to set up all the certificates and tls works fine > for me. > What if I want to put a proxy between client and server in libvirt? He has > his own CA, and this is only one more CA I would like libvirt to trust to. > Is it somehow achievable? I see that libvirt takes certificates only from > predefined paths. For me doesn't work if I just incert another CA > certificate to the cacert.pem file. Do you know any approaches how it can > be made in another way? The cacert.pem file can contain multiple certificates, just concatenate all the CA pem files. > > пн, 10 дек. 2018 г. в 12:38, Daniel P. Berrangé <berrange(a)redhat.com&gt;: > > > On Sat, Dec 08, 2018 at 11:19:40AM +0300, Anastasiya Ruzhanskaya wrote: > > > Hello! > > > Does libvirt uses certificate pinning in tls? I want to setup a > > transparent > > > proxy (mitmproxy) and can't do this even after I added mitmproxy ca > > > certificate to the trusted certificates in ubuntu. > > > > Libvirt doesn't ever use the global certificates stores, because public > > CAs are not relevant to libvirt deployments - indeed trusting the global > > cert store in the OS would lower security by opening it upto arbitrary > > CAs. See this doc for where libvirt finds CA certs > > > > https://libvirt.org/remote.html#Remote_certificates > > > > > > Regards, > > Daniel > > -- > > |: https://berrange.com -o- > > https://www.flickr.com/photos/dberrange :| > > |: https://libvirt.org -o- > > https://fstop138.berrange.com :| > > |: https://entangle-photo.org -o- > > https://www.instagram.com/dberrange :| > > Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

On Mon, Dec 10, 2018 at 01:22:32PM +0300, Anastasiya Ruzhanskaya wrote: > And how libvirt checks that it trusts the CA? Just simply inspects the > cacert.pem file? Or it has some information inside about by which CA were > signed client and server certificates and then compares against stored > values? I mean can I just concatenate after signing or I need to combine > two CAs before generating libvirt's client and server certificates? Libvirt will check that the server's certificate is signed by any one of the CAs listed. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|