Managing CA Certificates

How the Feature Works

CA certificates are the foundation of trust for TLS/SSL connections. During a TLS handshake, the server sends its certificate to the client. The client then uses its trusted CA certificate to verify the validity of the server's certificate. Once the server's identity is verified, an encrypted connection is established. Figure 1 illustrates the TLS handshake process that relies on CA certificates.

Figure 1 TLS handshake process

Table 1 compares the two types of CA certificates supported by CSS Logstash.

Requirements for Custom Certificate Files

Prepare custom certificate files according to the following requirements. Certificate upload will fail if these requirements are not met.

Viewing Default CA Certificates

Obtain the name and path of the default CA certificate provided by CSS, and reference the certificate in your Logstash configuration file to establish trust with CSS Elasticsearch/OpenSearch clusters.

1. Log in to the CSS management console.
2. In the navigation pane on the left, choose Clusters > Logstash.
3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
4. Choose Certificate Management > Default Certificates.
5. On the Default Certificates page, record the certificate name and path.

   Usage: In your Logstash configuration file, specify <certificate path><certificate name> in the cacert parameter. (Example: /opt/logstash/extend/certs)

Uploading a Custom CA Certificate

Import custom CA certificate files into the certificate management system of your Logstash cluster to generate certificate paths that can be referenced in Logstash configuration files. This enables Logstash to establish trust when connecting to third-party data sources.

1. Prepare and upload a custom certificate to an OBS bucket.
   1. Prepare a certificate file that meets the requirements described in Requirements for Custom Certificate Files.
   2. Upload the certificate file to an OBS bucket. For details, see Uploading an Object.
      • The OBS bucket must be in the same region as the Logstash cluster, and its storage class must be Standard.
      • If SSE-KMS is enabled for the OBS bucket, the account used for operations must have the following KMS permissions. (Choose Permissions > Policies/Roles on the IAM console to check your permissions.)

        "kms:cmk:create",
        "kms:dek:create",
        "kms:cmk:get",
        "kms:dek:decrypt",
        "kms:cmk:list"

2. Upload the certificate to the Logstash cluster.
   1. Log in to the CSS management console.
   2. In the navigation pane on the left, choose Clusters > Logstash.
   3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
   4. Choose Certificate Management > Custom Certificates.
   5. On the Custom Certificates page, click Upload Certificate. In the displayed dialog box, configure the required parameters.

      Table 3 Uploading a certificate

      Parameter	Description
      OBS Bucket	Select the OBS bucket where the certificate file has been uploaded. An IAM user must be granted the following OBS permissions to view available OBS buckets: obs:bucket:getBucketStoragePolicy obs:bucket:listAllMyBuckets
      Certificate Object	Click Select. In the displayed dialog box, select the target certificate file, and click OK.

   6. Click OK to upload the custom certificate.
   7. After the certificate is uploaded, it is displayed in the custom certificate list. Obtain the certificate name and path.

      Usage: In your Logstash configuration file, specify <certificate path><certificate name> in the cacert parameter. (Example: /opt/logstash/extend/certs)

3. (Optional) Delete expired or unused certificates.
   

   Before deleting a certificate, ensure that the certificate is no longer referenced by any pipeline. Otherwise, related pipelines will fail to connect to data sources after the certificate is deleted.

   1. In the custom certificate list, select the certificate to be deleted and click Delete in the Operation column.
   2. In the displayed dialog box, click OK to delete the certificate.

FAQ: How Do I Select a Custom CA Certificate Format?

Common options:

• .pem: A text-based format that is the most widely used and recommended for Linux environments.
• .crt/.cer: Certificate files that are commonly used together with .key files.
• .jks/.keystore: Java keystores used for Java-based connections.
• .pfx/.p12: PKCS#12 format files that contain private keys and certificate chains.

If you are not sure, .pem is recommended.