diff --git a/docs/transport.md b/docs/transport.md index 9b0bd7f7..a66bc7d6 100644 --- a/docs/transport.md +++ b/docs/transport.md @@ -6,11 +6,11 @@ By default, `rathole` forwards traffic as it is. Different options can be enable Checkout the [example](../examples/tls) ### Client Normally, a self-signed certificate is used. In this case, the client needs to trust the CA. `trusted_root` is the path to the root CA's certificate PEM file. -`hostname` is the hostname that the client used to validate aginst the certificate that the server presents. +`hostname` is the hostname that the client used to validate aginst the certificate that the server presents. Note that it does not have to be the same with the `remote_addr` in `[client]`. ``` [client.transport.tls] -trusted_root = "example/tls/ca-cert.pem" -hostname = "0.0.0.0" +trusted_root = "example/tls/rootCA.crt" +hostname = "localhost" ``` ### Server @@ -18,9 +18,17 @@ PKCS#12 archives are needed to run the server. It can be created using openssl like: ``` -openssl pkcs12 -export -out identity.pfx -inkey server-key.pem -in server-cert.pem -certfile ca_chain_certs.pem +openssl pkcs12 -export -out identity.pfx -inkey server.key -in server.crt -certfile ca_chain_certs.crt ``` +Aruguments are: + +- `-inkey`: Server Private Key +- `-in`: Server Certificate +- `-certfile`: CA Certificate + +Creating self-signed certificate with one's own CA is a non-trival task. However, a script is provided under tls example folder for reference. + ## Noise Protocol ### Quickstart for the Noise Protocl In one word, the [Noise Protocol](http://noiseprotocol.org/noise.html) is a lightweigt, easy to configure and drop-in replacement of TLS. No need to create a self-sign certificate to secure the connection. diff --git a/examples/tls/ca-cert.pem b/examples/tls/ca-cert.pem deleted file mode 100644 index 8bbf6489..00000000 --- a/examples/tls/ca-cert.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFazCCA1OgAwIBAgIUXTmJtkI6aK16A8HPkP2IvowmSKwwDQYJKoZIhvcNAQEL -BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM -GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMjAxMDIwODEzMzhaFw0yMzAy -MDMwODEzMzhaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw -HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggIiMA0GCSqGSIb3DQEB -AQUAA4ICDwAwggIKAoICAQDAAq3LEmJigEuRT9sswUx6Kfc4T04oZvZTSYNIRrBF -Zcc/EGZF/t/k2ciGDSAB1mL2rUdIfWveQ/5kRCSFffX5qvKFkzogRQQjFPLFjfoC -lKXxvy/BOIwF786gvHbz5EI1dcAL+nRco3U6dHPdewvbQwX9cZrUD3pq+r1qlipY -w5rZL7Z5cNoczhRAgFhIBHvsgBazkkOB7PDUkmkYAYnw3uK+r4coAqnnfjpxoaCQ -dQi4JX2VvqOdgxzw9vIRqbL+p2NBPnVjcSj067Y9sxtfR3Xmt2dlMJuReFN8phnK -8GiYiuiYA01O84htjHt+A8oVYKalXdPeikoSgPmhoJCQQs0NkBzGCc33U7XEa6kM -j6Y81Id4uXAK5LxyVGo5zOEvOyF3EhceIJDeGS9NsGJyT757OuKrsCK0v8KNPsEh -VvrcngnRQOWFTg/rp/vSrj7S5i0NPjkEpRitxaYBOg40DXyG1GfYf1SvneXpT0gh -ZbgjipPrwvuZnJVqqIv1hVVNOKo7nJS24rZ/andZS8g6OE0bL9AlE1Sp2lMXuagJ -2haPa2rSFZPqNPrP9wh5KVreD9UNeTb37NbXWeZXwKR8v20GAWjb2QQKY92zlMpI -gmViEvJHrHbKVoU/8gyS9R7iL9JOehk3sqVhbjaDyouC9mosPrQFzp1frKvSlKNg -1wIDAQABo1MwUTAdBgNVHQ4EFgQU98MJp09MMFw5s4sacYozQFzTNFwwHwYDVR0j -BBgwFoAU98MJp09MMFw5s4sacYozQFzTNFwwDwYDVR0TAQH/BAUwAwEB/zANBgkq -hkiG9w0BAQsFAAOCAgEABOtNqqKFEA3vynOFteZV+VquaRKqDuYn0doMMPH9cY20 -4ASioa3aqbmvBiSTDsOdvgP6j5nSVEtQCt5P3fBRMa8a3YnTGPNx8uGPuOA+ZD+b -USR5FcXJHtkjSfpVF9DOZr34+khRpfHPEZQiaAAiKwaRnI4Gqhv6e6JoaimkQDYj -xcKw+f1NcCdhSTkpcx9K/Qfa0cXKSL+0Hwl5AbDMsnRAkKu62YKdOv36nnBOMc2S -6laNIx20nt8Evm3KBNDRiHAw8pwMGfnxCCG6hGo2IvYh6hOjZupVpP55iMgQUkfF -Gmvxe/4wjuPCvI/Liy0PFfiCHVKASWIiMWG8u8WfJUw1/4RFZu4l2LVVuJOujr6n -1k5vzIozuo6Ym8mKnnHQmYf5K9T/YuRW3EFa9Ar6/krjw6K/I97P+Wh/DVZiaGC5 -n90ZcRj+abb+zOfz0AHTOp7zlr3w4si7AF3tZ9WhW2R0BC3wwmXygli0I6iMXE7E -tvXM5UwxLJoJen2fWqn75/91BifEqPWckPb1h14i73hAPVSte1wvstf8mER/DFSX -Is/GxAhRsZChHn2lEJsvPlrfyMxYwcXTTvd//sp+iOZjfky5vhRuMDUYsHx6/znT -q/rpT3CMnAVlMTf8n/0dY4mdcaQj0cRJfVnUlvZnhw0tJzCP3rH3smlpWloexds= ------END CERTIFICATE----- diff --git a/examples/tls/client.toml b/examples/tls/client.toml index ff239707..4a142826 100644 --- a/examples/tls/client.toml +++ b/examples/tls/client.toml @@ -1,12 +1,12 @@ [client] -remote_addr = "localhost:2333" +remote_addr = "127.0.0.1:2333" default_token = "123" [client.transport] type = "tls" [client.transport.tls] -trusted_root = "examples/tls/ca-cert.pem" -hostname = "0.0.0.0" +trusted_root = "examples/tls/rootCA.crt" +hostname = "localhost" [client.services.foo1] local_addr = "127.0.0.1:80" diff --git a/examples/tls/create_self_signed_cert.sh b/examples/tls/create_self_signed_cert.sh new file mode 100644 index 00000000..e110a1f4 --- /dev/null +++ b/examples/tls/create_self_signed_cert.sh @@ -0,0 +1,62 @@ +#!/bin/sh + +# create CA +openssl req -x509 \ + -sha256 -days 356 \ + -nodes \ + -newkey rsa:2048 \ + -subj "/CN=MyOwnCA/C=US/L=San Fransisco" \ + -keyout rootCA.key -out rootCA.crt + +# create server private key +openssl genrsa -out server.key 2048 + +# create certificate signing request (CSR) +cat > csr.conf < cert.conf <