Unable to Secure CloudStack System VMs with Dynamic URL

[vishnuvs369]

ISSUE TYPE

• Other

COMPONENT NAME

System VM's

CLOUDSTACK VERSION

4.19.0.1

SUMMARY

I'm facing difficulties securing CloudStack System VMs using SSL configuration, as described in the documentation provided by ShapeBlue ( https://www.shapeblue.com/securing-cloudstack-4-11-with-https-tls/)
Steps Taken:

1. Followed the steps outlined in the documentation to configure Dynamic URL for CloudStack System VMs.
2. Configured the required global settings as specified in the documentation.
3. Uploaded SSL certificates through the CloudStack UI for the system VMs.
4. Restarted the CloudStack management server and system VMs to apply the configuration changes.

Observations:

1. After completing the configuration steps, HTTPS access to the CloudStack System VMs is not functioning as expected.
2. Attempts to access the system VMs via HTTPS result in connection errors or unsuccessful HTTPS loading.
3. No visible indication of SSL encryption or secure connection is observed in the browser when accessing the System VMs.

[weizhouapache]

@vishnuvs369
what are the related globals settings ?
check https://www.shapeblue.com/securing-cloudstack-4-11-with-https-tls/

[vishnuvs369]

@weizhouapache
I enabled the following settings in global settings
consoleproxy.ssl True
secstorage.encrypt.copy True

Also Added domains in the below fields
consoleproxy.url.domain
secstorage.ssl.cert.domain

[weizhouapache]

@weizhouapache I enabled the following settings in global settings consoleproxy.ssl True secstorage.encrypt.copy True

Also Added domains in the below fields consoleproxy.url.domain secstorage.ssl.cert.domain

If you have restarted the management server, destroy the system vms and retry

[vishnuvs369]

@weizhouapache
I restarted management server and destoyed system vm's, still its not working.

[weizhouapache]

@weizhouapache I restarted management server and destoyed system vm's, still its not working.

@vishnuvs369
is the DNS name resolvable ?
check if ip and port 443/8443 are reachable from the client/browser
check if port 443/8443 is on listen in CPVM
...

[vishnuvs369]

@weizhouapache
Ports 443 and 8443 are listening in CPVM...and IP are reachable

[weizhouapache]

@weizhouapache Ports 443 and 8443 are listening in CPVM...and IP are reachable

any error/exception in /var/log/cloud.log in CPVM ?

[vishnuvs369]

@weizhouapache
No errors found on CPVM..

[weizhouapache]

@weizhouapache No errors found on CPVM..

is dns working ?

check dnsname:443 or dnsname:8443 by nc or telnet

[vishnuvs369]

@weizhouapache
I tried a telnet to 443 and 8443....443 is not connected

[weizhouapache]

@weizhouapache I tried a telnet to 443 and 8443....443 is not connected

both 443/8443 should work

you can go to CPVM, and check if 127.0.0.1 443/8443 and public ip 443/8443 work

[vishnuvs369]

@weizhouapache
I'm able to telnet 443/8443 from public IP and 127.0.0.1 but not able to telnet 443 from domain name where as 8443 is working.
where i have gone wrong?

[DaanHoogland]

@weizhouapache I tried a telnet to 443 and 8443....443 is not connected

@vishnuvs369 are these attempts from outside your cloud?
if yes, check if there is a firewall keeping you from connecting.
if no, can you share the firewall rules in your cpvm, and a traceroute from where you are trying to access your console?

[sureshanaparti]

@weizhouapache I tried a telnet to 443 and 8443....443 is not connected

@vishnuvs369 are these attempts from outside your cloud? if yes, check if there is a firewall keeping you from connecting. if no, can you share the firewall rules in your cpvm, and a traceroute from where you are trying to access your console?

Hi @vishnuvs369 Any update on this, are you able to check the firewall rules, anything blocking there?