Merge branch '19175-doc-refactor-multi-host-installation'

[arvados.git] / doc / _includes / _install_ca_cert.liquid

{% comment %}
Copyright (C) The Arvados Authors. All rights reserved.

SPDX-License-Identifier: CC-BY-SA-3.0
{% endcomment %}

h2(#ca_root_certificate). Install the CA root certificate (SSL_MODE=self-signed only)

Arvados uses SSL to encrypt communications. The web interface uses AJAX which will silently fail if the certificate is not valid or signed by an unknown Certification Authority.

For this reason, the @arvados-formula@ has a helper state to create a root certificate to authorize Arvados services. The @provision.sh@ script will leave a copy of the generated CA's certificate (@arvados-snakeoil-ca.pem@) in the script's directory so you can add it to your workstation.

Installing the root certificate into your web browser will prevent security errors when accessing Arvados services with your web browser.

# Go to the certificate manager in your browser.
#* In Chrome, this can be found under "Settings → Advanced → Manage Certificates" or by entering @chrome://settings/certificates@ in the URL bar.
#* In Firefox, this can be found under "Preferences → Privacy & Security" or entering @about:preferences#privacy@ in the URL bar and then choosing "View Certificates...".
# Select the "Authorities" tab, then press the "Import" button.  Choose @arvados-snakeoil-ca.pem@

The certificate will be added under the "Arvados Formula".

To access your Arvados instance using command line clients (such as arv-get and arv-put) without security errors, install the certificate into the OS certificate storage.

* On Debian/Ubuntu:

<notextile>
<pre><code>cp arvados-root-cert.pem /usr/local/share/ca-certificates/
/usr/sbin/update-ca-certificates
</code></pre>
</notextile>

* On CentOS:

<notextile>
<pre><code>cp arvados-root-cert.pem /etc/pki/ca-trust/source/anchors/
/usr/bin/update-ca-trust
</code></pre>
</notextile>