1COCKPIT-TLS(8) cockpit-tls COCKPIT-TLS(8)
2
6 cockpit-tls - TLS proxy for Cockpit web service
7
9 cockpit-tls [--help] [--port PORT] [--no-tls] [--idle-timeout SECONDS]
10
12 The cockpit-tls program is a TLS terminating HTTP proxy for cockpit-
13 ws(8). It manages a set of isolated cockpit-ws instances, one per TLS
14 client certificate, plus one for TLS without a client certificate, and
15 one for unencrypted HTTP. With that, one session cannot tamper with
16 another one through possible security vulnerability exploits.
17 Users or administrators should never need to start this program as it
19 automatically started by systemd(1) via socket activation.
20
22 To specify the TLS certificate the web service should use, simply drop
23 a file with the extension .cert in the /etc/cockpit/ws-certs.d
24 directory. If there are multiple files in this directory, then the
25 highest priority one is chosen after sorting.
26 The .cert file should contain at least two OpenSSL style PEM blocks.
28 First one or more BEGIN CERTIFICATE blocks for the server certificate
29 and intermediate certificate authorities and a second one containing a
30 BEGIN PRIVATE KEY or similar. The key must not be encrypted.
31 If there is no TLS certificate, a self-signed certificate is
33 automatically generated using sscg (if available) or openssl and stored
34 in the 0-self-signed.cert file.
35 When enrolling into a FreeIPA domain, an SSL certificate is requested
37 from the IPA server and stored in 10-ipa.cert.
38 To check which certificate cockpit-ws will use, run the following
40 command.
41 $ sudo remotectl certificate
43 If using certmonger to manage certificates, following command can be
45 used to automatically prepare concatenated .cert file:
46 CERT_FILE=/etc/pki/tls/certs/$(hostname).pem
48 KEY_FILE=/etc/pki/tls/private/$(hostname).key
49 getcert request -f ${CERT_FILE} -k ${KEY_FILE} -D $(hostname --fqdn) -C "sed -n w/etc/cockpit/ws-certs.d/50-from-certmonger.cert ${CERT_FILE} ${KEY_FILE}"
51
53 --help
54 Show help options.
55 --port PORT
57 Serve HTTP requests on PORT instead of port 9090. Usually Cockpit
58 is started on demand by systemd socket activation, and this option
59 has no effect. Update the ListenStream directive cockpit.socket
60 file in the usual systemd manner.
61 --no-tls
63 Don't use TLS. Certificates will not be read, and https connections
64 denied. Then cockpit-tls will only manage a single cockpit-ws
65 instance, and thus not do anything different than running
66 cockpit-ws --no-tls directly. Only use this for debugging or
67 testing.
68 --idle-timeout SECONDS
70 If greater than 0, exit if no connections have happened for the
71 given number of seconds, i. e. the server is idle. If not given,
72 the default is 90.
73
75 The cockpit-tls program expects the RUNTIME_DIRECTORY environment
76 variable to be set to an empty directory (preferably in /run/) that is
77 only accessible by the system user under which it is running. This
78 contains the Unix sockets for communicating with the cockpit-ws
79 instances, and in the future, state information about client
80 certificates. This variable is normally set by the cockpit.service
81 systemd unit.
82 In addition, cockpit-tls will use the XDG_CONFIG_DIRS environment
84 variable from the XDG basedir spec[1] to find its certificates and the
85 cockpit.conf(5) configuration file.
86
88 Please send bug reports to either the distribution bug tracker or the
89 upstream bug tracker[2].
90
92 Cockpit has been written by many contributors[3].
93
95 cockpit-ws(8) , cockpit.conf(5) , systemd(1)
96
98 1. XDG basedir spec
99 https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
100 2. upstream bug tracker
102 https://github.com/cockpit-project/cockpit/issues/new
103 3. contributors
105 https://github.com/cockpit-project/cockpit/graphs/contributors
106cockpit 05/16/2021 COCKPIT-TLS(8)