OpenStack endpoints are HTTP services providing APIs to both end-users on public networks and to other OpenStack services within the same deployment operating over the management network. It is highly recommended these requests, both those internal and external, operate over SSL. In order for API requests to be encrypted by SSL it's necessary to position the API services behind a proxy that will establish and terminate SSL sessions. The following table offers a non-exhaustive list of software services that can proxy SSL traffic for API requests: Pound Stud nginx Apache httpd Hardware appliance SSL acceleration proxies It is important to be mindful of the size of requests that will be processed by any chosen SSL proxy.

Below we provide some sample configuration setting for enabling SSL in some of the most popular web servers/SSL terminators with recommended configurations. Note that we have SSL v3 enabled in some of these examples as this will be required in many deployments for client compatibility.

  ## see pound(8) for details daemon 1 ###################################################################### ## global options: User "swift" Group "swift" #RootJail "/chroot/pound" ## Logging: (goes to syslog by default) ## 0 no logging ## 1 normal ## 2 extended ## 3 Apache-style (common log format) LogLevel 0 ## turn on dynamic scaling (off by default) # Dyn Scale 1 ## check backend every X secs: Alive 30 ## client timeout #Client 10 ## allow 10 second proxy connect time ConnTO 10 ## use hardware-accelleration card supported by openssl(1): SSLEngine "aesni" # poundctl control socket Control "/var/run/pound/poundctl.socket" ###################################################################### ## listen, redirect and ... to: ## redirect all swift requests on port 443 to local swift proxy ListenHTTPS Address 0.0.0.0 Port 443 Cert "/etc/pound/cert.pem" ## Certs to accept from clients ## CAlist "CA_file" ## Certs to use for client verification ## VerifyList "Verify_file" ## Request client cert - don't verify ## Ciphers "AES256-SHA" ## allow PUT and DELETE also (by default only GET, POST and HEAD)?: NoHTTPS11 0 ## allow PUT and DELETE also (by default only GET, POST and HEAD)?: xHTTP 1 Service BackEnd Address 127.0.0.1 Port 80 End End End

This stud example enables SSL v3 for client compatibility.  The ciphers line can be tweaked based on your needs, however this is a reasonable starting place.   # SSL x509 certificate file. pem-file = " # SSL protocol. ssl = on # List of allowed SSL ciphers. # OpenSSL's high-strength ciphers which require authentication # NOTE: This list does not include any RC4 ciphers. ciphers = "HIGH:!aNULL:!eNULL:!DES:!3DES" # Enforce server cipher list order prefer-server-ciphers = on # Number of worker processes workers = 4 # Listen backlog size backlog = 1000 # TCP socket keepalive interval in seconds keepalive = 3600 # Chroot directory chroot = "" # Set uid after binding a socket user = "www-data" # Set gid after binding a socket group = "www-data" # Quiet execution, report only error messages quiet = off # Use syslog for logging syslog = on # Syslog facility to use syslog-facility = "daemon" # Run as daemon daemon = off # Report client address using SENDPROXY protocol for haproxy # Disabling this until we upgrade to HAProxy 1.5 write-proxy = off

This nginx example requires TLS v1.1 or v1.2 for maximum security. The ssl_ciphers line can be tweaked based on your needs, however this is a reasonable starting place.   server { listen : ssl; ssl_certificate ; ssl_certificate_key ; ssl_protocols TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!eNULL:!DES:!3DES; server_name _; keepalive_timeout 5; location / { } }

  <VirtualHost <ip address>:80> ServerName <site FQDN> RedirectPermanent / https://<site FQDN>/ </VirtualHost> <VirtualHost <ip address>:443> ServerName <site FQDN> SSLEngine On SSLProtocol +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, SSLCipherSuite HIGH:!aNULL:!eNULL:!DES:!3DES; SSLCertificateFile /path/<site FQDN>.crt SSLCACertificateFile /path/<site FQDN>.crt SSLCertificateKeyFile /path/<site FQDN>.key WSGIScriptAlias / <WSGI script location> WSGIDaemonProcess horizon user=<user> group=<group> processes=3 threads=10 Alias /static <static files location> <Directory <WSGI dir>> # For http server 2.2 and earlier: Order allow,deny Allow from all # Or, in Apache http server 2.4 and later: # Require all granted </Directory> </VirtualHost> Compute API SSL endpoint in Apache2, which needs to be paired with a short WSGI script.   <VirtualHost <ip address>:8447> ServerName <site FQDN> SSLEngine On SSLProtocol +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2, SSLCipherSuite HIGH:!aNULL:!eNULL:!DES:!3DES; SSLCertificateFile /path/<site FQDN>.crt SSLCACertificateFile /path/<site FQDN>.crt SSLCertificateKeyFile /path/<site FQDN>.key WSGIScriptAlias / <WSGI script location> WSGIDaemonProcess osapi user=<user> group=<group> processes=3 threads=10 <Directory <WSGI dir>> # For http server 2.2 and earlier: Order allow,deny Allow from all # Or, in Apache http server 2.4 and later: # Require all granted </Directory> </VirtualHost>

We recommend that all production deployments use HSTS. This header prevents browsers from making insecure connections after they have made a single secure one. If you have deployed your HTTP services on a public or an untrusted domain, HSTS is especially important. To enable HSTS, configure your web server to send a header like this with all requests: Strict-Transport-Security: max-age=31536000; includeSubDomains Start with a short timeout of 1 day during testing, and raise it to one year after testing has shown that you haven't introduced problems for users. Note that once this header is set to a large timeout, it is (by design) very difficult to disable.