Setting up mutual TLS (mTLS)

How to Set Up Mutual TLS (mTLS) in Linux Bash

Securing communication between servers is crucial in any IT environment focusing on data integrity and confidentiality. One of the most effective ways to achieve this is through Mutual TLS (mTLS), an extension of TLS (Transport Layer Security) that requires both the client and the server to authenticate each other. This ensures a bi-directional security mechanism that increases trust between communicating parties. This article will guide you through the setup process of mTLS on a Linux system using Bash.

Prerequisites

Before diving into the setup process, please ensure you have the following:

OpenSSL: This tool will help in generating keys and certificates.
Access to Terminal or Command Line Interface on Linux.
Root or sudo privileges: Necessary for installing packages and editing configuration files.
Two Linux servers (or virtual machines), one acting as the server and the other as the client.

Step 1: Install OpenSSL

If OpenSSL is not installed on your Linux servers, you can install it using your package manager. For Debian-based systems like Ubuntu:

sudo apt-get update
sudo apt-get install openssl

For Red Hat-based systems like CentOS:

sudo yum update
sudo yum install openssl

Step 2: Create Your Root Certificate Authority (CA)

Generate a private key for the CA:
```
openssl genrsa -out myCA.key 2048
```

Create and self-sign the root certificate:

openssl req -x509 -new -nodes -key myCA.key -sha256 -days 1024 -out myCA.pem

Provide the necessary details when prompted. This certificate acts as a trusted authority for your setup.

Step 3: Create Server and Client Certificates

Both the server and client need their own certificates signed by the CA created above.

For the Server:

Generate a private key:
```
openssl genrsa -out server.key 2048
```

Generate a CSR (Certificate Signing Request):

openssl req -new -key server.key -out server.csr

Sign the CSR with your CA:

openssl x509 -req -in server.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out server.crt -days 500 -sha256

For the Client:

Repeat the steps for the server, replacing "server" with "client" in the commands.

Step 4: Configure the Server to Use mTLS

This configuration varies by application and server software. Here’s a general approach using NGINX:

Edit the NGINX configuration file to enable SSL and client certificate verification:

server {
   listen 443 ssl;
   server_name your_server_domain_or_IP;

   ssl_certificate /path/to/server.crt;
   ssl_certificate_key /path/to/server.key;
   ssl_client_certificate /path/to/myCA.pem;
   ssl_verify_client on;

   location / {
       proxy_pass http://localhost:3000;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
   }
}

Restart NGINX to apply the changes.
```
sudo systemctl restart nginx
```

Step 5: Test Your Setup

Use curl from your client machine to test the connection:

curl --cacert path/to/myCA.pem --cert path/to/client.crt --key path/to/client.key https://your_server_domain_or_IP

If set up correctly, you should see the intended response from the server.

Conclusion

mTLS adds an additional layer of security by requiring both parties to prove their identities before any data is exchanged, thereby mitigating potential threats such as MITM (Man In The Middle) attacks. The process of setting up mTLS can be intensive but is invaluable for secure communication. Both server and client contribute to the overall security, ensuring data integrity and confidentiality across the established communication line. By following the steps outlined above, you can implement a robust authentication mechanism for both your clients and servers within your infrastructure.