1COCKPIT-TLS(8)                    cockpit-tls                   COCKPIT-TLS(8)
2
3
4

NAME

6       cockpit-tls - TLS proxy for Cockpit web service
7

SYNOPSIS

9       cockpit-tls [--help] [--port PORT] [--no-tls] [--idle-timeout SECONDS]
10

DESCRIPTION

12       The cockpit-tls program is a TLS terminating HTTP proxy for cockpit-
13       ws(8). It manages a set of isolated cockpit-ws instances, one per TLS
14       client certificate, plus one for TLS without a client certificate, and
15       one for unencrypted HTTP. With that, one session cannot tamper with
16       another one through possible security vulnerability exploits.
17
18       Users or administrators should never need to start this program as it
19       automatically started by systemd(1) via socket activation.
20

TRANSPORT SECURITY

22       To specify the TLS certificate the web service should use, simply drop
23       a file with the extension .cert in the /etc/cockpit/ws-certs.d
24       directory. If there are multiple files in this directory, then the
25       highest priority one is chosen after sorting.
26
27       The .cert file should contain at least two OpenSSL style PEM blocks.
28       First one or more BEGIN CERTIFICATE blocks for the server certificate
29       and intermediate certificate authorities and a second one containing a
30       BEGIN PRIVATE KEY or similar. The key must not be encrypted.
31
32       If there is no TLS certificate, a self-signed certificate is
33       automatically generated using sscg (if available) or openssl and stored
34       in the 0-self-signed.cert file.
35
36       When enrolling into a FreeIPA domain, an SSL certificate is requested
37       from the IPA server and stored in 10-ipa.cert.
38
39       To check which certificate cockpit-ws will use, run the following
40       command.
41
42           $ sudo remotectl certificate
43
44       If using certmonger to manage certificates, following command can be
45       used to automatically prepare concatenated .cert file:
46
47           CERT_FILE=/etc/pki/tls/certs/$(hostname).pem
48           KEY_FILE=/etc/pki/tls/private/$(hostname).key
49
50           getcert request -f ${CERT_FILE} -k ${KEY_FILE} -D $(hostname --fqdn) -C "sed -n w/etc/cockpit/ws-certs.d/50-from-certmonger.cert ${CERT_FILE} ${KEY_FILE}"
51

OPTIONS

53       --help
54           Show help options.
55
56       --port PORT
57           Serve HTTP requests on PORT instead of port 9090. Usually Cockpit
58           is started on demand by systemd socket activation, and this option
59           has no effect. Update the ListenStream directive cockpit.socket
60           file in the usual systemd manner.
61
62       --no-tls
63           Don't use TLS. Certificates will not be read, and https connections
64           denied. Then cockpit-tls will only manage a single cockpit-ws
65           instance, and thus not do anything different than running
66           cockpit-ws --no-tls directly. Only use this for debugging or
67           testing.
68
69       --idle-timeout SECONDS
70           If greater than 0, exit if no connections have happened for the
71           given number of seconds, i. e. the server is idle. If not given,
72           the default is 90.
73

ENVIRONMENT

75       The cockpit-tls program expects the RUNTIME_DIRECTORY environment
76       variable to be set to an empty directory (preferably in /run/) that is
77       only accessible by the system user under which it is running. This
78       contains the Unix sockets for communicating with the cockpit-ws
79       instances, and in the future, state information about client
80       certificates. This variable is normally set by the cockpit.service
81       systemd unit.
82
83       In addition, cockpit-tls will use the XDG_CONFIG_DIRS environment
84       variable from the XDG basedir spec[1] to find its certificates and the
85       cockpit.conf(5) configuration file.
86

BUGS

88       Please send bug reports to either the distribution bug tracker or the
89       upstream bug tracker[2].
90

AUTHOR

92       Cockpit has been written by many contributors[3].
93

SEE ALSO

95       cockpit-ws(8) , cockpit.conf(5) , systemd(1)
96

NOTES

98        1. XDG basedir spec
99           https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
100
101        2. upstream bug tracker
102           https://github.com/cockpit-project/cockpit/issues/new
103
104        3. contributors
105           https://github.com/cockpit-project/cockpit/graphs/contributors
106
107
108
109cockpit                           05/16/2021                    COCKPIT-TLS(8)
Impressum