TLS Certificates for Secure Inter-Service Communication

Question

Pulumi · Accepted Answer

TLS certificates are an essential part of secure communication in a distributed system. They provide encryption, data integrity, and authentication, ensuring that your services can communicate securely with one another over a network. In this program, we will use Pulumi and the TLS provider to generate a locally signed TLS certificate which can be used for secure communication between microservices.

Firstly, we'll generate a new RSA private key. This key will be the basis for our Certificate Authority (CA) and the TLS certificates signed by this authority.

Secondly, we'll create a new self-signed CA certificate using the private key. This certificate acts as a root for trust; any certificate signed by this CA will be trusted by services that trust the CA certificate.

After that, we'll generate a certificate signing request (CSR) for a microservice, which includes information such as the Common Name (CN), as well as Alternative Names (SANs) for additional hostnames or IPs the service may be accessed through.

Finally, we'll issue a certificate signed by our CA for the microservice using the CSR.

Here's how you would write this program in Pulumi using Python:

```python
import pulumi
import pulumi_tls as tls

# Step 1: Generate a private key for the root Certificate Authority
ca_private_key = tls.PrivateKey("ca-private-key",
    algorithm="RSA", # You can choose the algorithm, RSA is common
)

# Step 2: Create a self-signed root certificate for CA using the private key
ca_certificate = tls.SelfSignedCert("ca-certificate",
    key_algorithm=ca_private_key.algorithm,
    private_key_pem=ca_private_key.private_key_pem,
    subjects=[{"commonName": "my-ca"}],
    validity_period_hours=87600, # 10 years
    is_ca_certificate=True,
    allowed_uses=[
        "key_encipherment",
        "digital_signature",
        "cert_signing",
    ],
)

# Step 3: Generate a new private key for the service
service_private_key = tls.PrivateKey("service-private-key",
    algorithm="RSA", # Match the algorithm to the one used for the CA
)

# Step 4: Create a CSR for the service
service_csr = tls.CertRequest("service-csr",
    key_algorithm=service_private_key.algorithm,
    private_key_pem=service_private_key.private_key_pem,
    subjects=[{"commonName": "my-microservice"}],
)

# Step 5: Issue a certificate for the service signed by our CA
service_certificate = tls.LocallySignedCert("service-certificate",
    ca_key_algorithm=ca_private_key.algorithm,
    ca_private_key_pem=ca_private_key.private_key_pem,
    ca_cert_pem=ca_certificate.cert_pem,
    cert_request_pem=service_csr.cert_request_pem,
    validity_period_hours=8760, # 1 year
    allowed_uses=[
        "key_encipherment",
        "digital_signature",
        "server_auth",
    ],
)

# Export the certificate and private key for use in your applications
pulumi.export("ca_certificate_pem", ca_certificate.cert_pem)
pulumi.export("service_certificate_pem", service_certificate.cert_pem)
pulumi.export("service_private_key_pem", service_private_key.private_key_pem)
```

In the code above:
- We use `tls.PrivateKey` to create private keys for both the CA and the microservice.
- The `tls.SelfSignedCert` resource generates a self-signed certificate for our CA.
- Next, `tls.CertRequest` creates a CSR for the microservice.
- `tls.LocallySignedCert` is used to sign the microservice's CSR with the CA's private key, therefore issuing a certificate that's trusted by any service that trusts the CA.

This approach can scale up for multiple microservices by repeating steps 3 to 5 for each one. You can also customize Common Names, domains, IP addresses, and other certificate properties according to your needs.

Remember to store your private keys and certificates securely, and rotate them before they expire or if they are compromised. With Pulumi's infrastructure as code, it becomes manageable to rotate keys and certificates because most of the process is automated and can be tracked as part of your application's version-controlled codebase.