Enable Multiple Domain TLS for Buckit

Buckit supports Transport Layer Security (TLS) 1.2+ encryption of incoming and outgoing traffic.

Buckit automatically detects TLS certificates in the configured or default directory and starts with TLS enabled.

The Buckit server supports multiple TLS certificates, where the server uses Server Name Indication (SNI) to identify which certificate to use when responding to a client request. When a client connects using a specific hostname, Buckit uses SNI to select the appropriate TLS certificate for that hostname.

This procedure documents enabling TLS for multiple domains in Buckit. For instructions on TLS for single domains, see TODO

Prerequisites

Access to Buckit Cluster

This procedure uses bm for performing operations on the Buckit cluster. Install bm on a machine with network access to the cluster. See the bm Installation Quickstart for instructions on downloading and installing bm.

This procedure assumes a configured alias for the Buckit cluster.

This procedure also assumes SSH or similar shell-level access with administrative permissions to each Buckit host server.

TLS Certificates

Provision the necessary TLS certificates with a supported cipher suite for use by Buckit.

Provision certificate susing your preferred path, such as through your organizations internal Certificate Authority or by using a well-known global provider such as Digicert or Verisign.

You can create self-signed certificates using openssl.

For example, the following command generates a self-signed certificate with DNS Subject Alternative Names (SANs) associated to the Buckit Server hosts:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout private.key \
  -out public.crt \
  -subj "/CN=localhost" \
  -addext "subjectAltName = DNS:localhost,DNS:*.example.net"

See TLS for Buckit for more complete guidance on certificate generation and placement.

Procedure

The Buckit Server searches for TLS keys and certificates for each node and uses those credentials for enabling TLS. Buckit automatically enables TLS upon discovery and validation of certificates.

You can specify the path for the Buckit server to search for certificates using buckit server --certs-dir or -S.

For example, the following command fragment directs the Buckit process to use the /opt/buckit/certs directory for TLS certificates.

buckit server --certs-dir /opt/buckit/certs ...

For systemd-managed deployments, modify MINIO_OPTS in /etc/default/minio to include the --certs-dir option.

The user running the Buckit service must have read and write permissions to this directory.

Place the certificates in the /certs folder, creating a subfolder in /certs for each additional domain for which Buckit should present TLS certificates. While Buckit has no requirements for folder names, consider creating subfolders whose name matches the domain to improve human readability. Place the TLS private and public key for that domain in the subfolder.

/path/to/certs
   private.key
   public.crt
   s3-example.net/
      private.key
      public.crt
   internal-example.net/
      private.key
      public.crt