TLS and mTLS Certificates¶

VNetArmor can use TLS for public/frontend traffic and mTLS for administrative communication between operators, WebGUI, GUI, Managerd, and Core management APIs.

Use generic names in your certificates such as manager01.example.local, core01.example.local, and admin.example.local.

Create a private CA¶

mkdir -p certs && cd certs
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
  -subj "/CN=Example VNetArmor Admin CA" \
  -out ca.crt

Create a Managerd server certificate¶

cat > managerd-san.cnf <<'EOF'
[req]
distinguished_name=req_distinguished_name
req_extensions=v3_req
prompt=no
[req_distinguished_name]
CN=manager01.example.local
[v3_req]
keyUsage=keyEncipherment,dataEncipherment,digitalSignature
extendedKeyUsage=serverAuth
subjectAltName=@alt_names
[alt_names]
DNS.1=manager01.example.local
DNS.2=manager.example.local
IP.1=10.0.10.20
EOF

openssl genrsa -out managerd.key 4096
openssl req -new -key managerd.key -out managerd.csr -config managerd-san.cnf
openssl x509 -req -in managerd.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out managerd.crt -days 825 -sha256 -extensions v3_req -extfile managerd-san.cnf

Create an operator/client certificate¶

cat > operator-san.cnf <<'EOF'
[req]
distinguished_name=req_distinguished_name
req_extensions=v3_req
prompt=no
[req_distinguished_name]
CN=operator-admin
[v3_req]
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=clientAuth
EOF

openssl genrsa -out operator.key 4096
openssl req -new -key operator.key -out operator.csr -config operator-san.cnf
openssl x509 -req -in operator.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out operator.crt -days 825 -sha256 -extensions v3_req -extfile operator-san.cnf

Verify certificates¶

openssl verify -CAfile ca.crt managerd.crt
openssl verify -CAfile ca.crt operator.crt

Test mTLS connectivity¶

grpcurl \
  -cacert ca.crt \
  -cert operator.crt \
  -key operator.key \
  manager01.example.local:9443 list

Common mTLS errors¶

Symptom	Likely cause	Resolution
`certificate signed by unknown authority`	Client does not trust the CA.	Use the correct CA file.
`bad certificate`	Client certificate missing or not valid for client authentication.	Reissue cert with `extendedKeyUsage=clientAuth`.
Hostname verification failure	SAN does not include the hostname used by the client.	Reissue server certificate with correct DNS/IP SANs.
Connection timeout	Firewall or service not listening.	Check Managerd port and network policy.