<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Stefan,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I think so, but I'm not sure if it's best practice to share that certificate with Kea since you'd need to open up permissions a little and allow Kea to read the private key. If you have no qualms with that note, then it's probably worth an attempt, at least.
Since Kea shouldn't be running as root, you may need to change group ownership of the certs or use fACLs.</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<b>Eric Graham</b></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i>DevOps Specialist</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size: 8pt;">Direct: 605.990.1859</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span></i><a href="mailto:eric.graham@vantagepnt.com" title="mailto:eric.graham@vantagepnt.com"><span style="font-size: 8pt;">Eric.Graham@vantagepnt.com</span></a><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><img style="max-width:100%" class="ContentPasted0" id="imageSelected0" data-outlook-trace="F:1|T:1" src="cid:5b21c730-a772-4f63-a022-cd498fb2bc5e"><br>
</i></div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Kea-users <kea-users-bounces@lists.isc.org> on behalf of Stefan G. Weichinger <lists@xunil.at><br>
<b>Sent:</b> Thursday, June 29, 2023 3:02 AM<br>
<b>To:</b> kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject:</b> Re: [Kea-users] kea-2.2.0 - HA cluster - communication between stork and dhcp4 gets lost</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated outside the organization. Do not click any links or attachments unless you have verified the sender.<br>
<br>
Am 28.06.23 um 09:28 schrieb Stefan G. Weichinger:<br>
> Am 27.06.23 um 17:17 schrieb Eric Graham:<br>
>> Stefan,<br>
>><br>
>> Make sure that when you change the password, you also change it in<br>
>> Stork and in the HA hook config on each daemon of each server.<br>
>><br>
>> I am not aware of documentation from ISC for generating certificates,<br>
><br>
> this:<br>
><br>
> <a href="https://github.com/isc-projects/kea/blob/master/src/lib/asiolink/testutils/ca/doc.txt">
https://github.com/isc-projects/kea/blob/master/src/lib/asiolink/testutils/ca/doc.txt</a><br>
><br>
> ?<br>
<br>
The two Kea-Servers are also samba-AD-DCs : so they have their own<br>
AD-related TLS-certs here:<br>
<br>
# ls -l /var/lib/samba/private/tls<br>
insgesamt 12<br>
-rw-r--r-- 1 root root 2074 30. Nov 2022 ca.pem<br>
-rw-r--r-- 1 root root 2078 30. Nov 2022 cert.pem<br>
-rw------- 1 root root 3243 30. Nov 2022 key.pem<br>
<br>
May I "simply" use these for kea as well? I assume so ...<br>
--<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
To unsubscribe visit <a href="https://lists.isc.org/mailman/listinfo/kea-users">https://lists.isc.org/mailman/listinfo/kea-users</a>.<br>
<br>
Kea-users mailing list<br>
Kea-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users">https://lists.isc.org/mailman/listinfo/kea-users</a><br>
</div>
</span></font></div>
</body>
</html>