PROVIDING SSL CONNECTIVITY INSIDE SOFTWARE DEFINED DATACENTERS WITH HYPERCONVERGED INFRASTRUCTURE
The present disclosure is related to devices, systems, and methods for providing SSL connectivity inside SDDCs with hyperconverged infrastructure. An example method can include configuring a primary Secure Sockets Layer (SSL) certificate on an endpoint of a hyperconverged infrastructure (HCI), configuring a secondary SSL certificate on the endpoint, securing data communicated between the endpoint and another endpoint of the HCI using the primary certificate, securing data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the primary certificate, responsive to determining a fault in the primary certificate, and securing data communicated between the endpoint and the other endpoint using a new primary certificate configured on the endpoint, instead of the secondary certificate, responsive to the new primary certificate being configured on the endpoint.
1 . A method, comprising:
configuring a primary Secure Sockets Layer (SSL) certificate on an endpoint of a hyperconverged infrastructure (HCI);
configuring a secondary SSL certificate on the endpoint;
securing data communicated between the endpoint and another endpoint of the HCI using the primary certificate;
securing data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the primary certificate, responsive to determining a fault in the primary certificate; and
securing data communicated between the endpoint and the other endpoint using a new primary certificate configured on the endpoint, instead of the secondary certificate, responsive to the new primary certificate being configured on the endpoint.
2 . The method of claim 1 , wherein the method includes:
configuring the primary certificate on a first port of the endpoint; and
configuring the secondary certificate on a second port of the endpoint.
3 . The method of claim 2 , wherein the method includes limiting access to the second port to a particular set of Internet Protocol (IP) addresses.
4 . The method of claim 1 , wherein the method includes limiting exposure to a port number of the second port of the endpoint to local endpoints of the HCI.
5 . The method of claim 1 , wherein a key size of the secondary certificate is exceeded by a key size of the primary certificate and a key size of the new primary certificate, and wherein a lifespan of the secondary certificate exceeds a lifespan of the primary certificate and a lifespan of the new primary certificate.
6 . The method of claim 1 , wherein the method includes:
securing data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the new primary certificate, responsive to determining a fault in the new primary certificate; and
configuring another new primary SSL certificate and securing data communicated between the endpoint and the other endpoint using the other new primary certificate instead of the secondary certificate.
7 . The method of claim 1 , wherein determining the fault in the primary certificate includes determining that:
the primary certificate was involved in a security breach;
the primary certificate expired; or
the primary certificate malfunctioned.
8 . A non-transitory machine-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:
configure a primary Secure Sockets Layer (SSL) certificate on an endpoint of a hyperconverged infrastructure (HCI);
configure a secondary SSL certificate on the endpoint;
secure data communicated between the endpoint and another endpoint of the HCI using the primary certificate;
secure data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the primary certificate, responsive to determining a fault in the primary certificate; and
secure data communicated between the endpoint and the other endpoint using a new primary certificate configured on the endpoint, instead of the secondary certificate, responsive to the new primary certificate being configured on the endpoint.
9 . The medium of claim 8 , including instructions to:
configure the primary certificate on a first port of the endpoint; and
configure the secondary certificate on a second port of the endpoint.
10 . The medium of claim 9 , including instructions to limit access to the second port to a particular set of Internet Protocol (IP) addresses.
11 . The medium of claim 8 , including instructions to limit exposure to a port number of the second port of the endpoint to local endpoints of the HCI.
12 . The medium of claim 8 , wherein a key size of the secondary certificate is exceeded by a key size of the primary certificate and a key size of the new primary certificate, and wherein a lifespan of the secondary certificate exceeds a lifespan of the primary certificate and a lifespan of the new primary certificate.
13 . The medium of claim 8 , including instructions to:
secure data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the new primary certificate, responsive to determining a fault in the new primary certificate; and
configure another new primary SSL certificate and secure data communicated between the endpoint and the other endpoint using the other new primary certificate instead of the secondary certificate.
14 . The medium of claim 8 , wherein the instructions to determine the fault in the primary certificate include instructions to determine that:
the primary certificate was involved in a security breach;
the primary certificate expired; or
the primary certificate malfunctioned.
15 . A system, comprising:
a primary certificate engine configured to configure a primary Secure Sockets Layer (SSL) certificate on an endpoint of a hyperconverged infrastructure (HCI);
a secondary certificate engine configured to configure a secondary SSL certificate on the endpoint;
a first communication engine configured to secure data communicated between the endpoint and another endpoint of the HCI using the primary certificate;
a second communication engine configured to secure data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the primary certificate, responsive to determining a fault in the primary certificate; and
a new primary certificate engine configured to secure data communicated between the endpoint and the other endpoint using a new primary certificate configured on the endpoint, instead of the secondary certificate, responsive to the new primary certificate being configured on the endpoint.
16 . The system of claim 15 , wherein:
the primary certificate engine is configured to configure the primary certificate on a first port of the endpoint; and
the secondary certificate engine is configured to configure the secondary certificate on a second port of the endpoint.
17 . The system of claim 16 , wherein the secondary certificate engine is configured to limit access to the second port to a particular set of Internet Protocol (IP) addresses.
18 . The system of claim 15 , wherein the secondary certificate engine is configured to limit exposure to a port number of the second port of the endpoint to local endpoints of the HCI.
19 . The system of claim 15 , wherein a key size of the secondary certificate is exceeded by a key size of the primary certificate and a key size of the new primary certificate, and wherein a lifespan of the secondary certificate exceeds a lifespan of the primary certificate and a lifespan of the new primary certificate.
20 . The system of claim 15 , wherein:
The second communication engine is configured to secure data communicated between the endpoint and the other endpoint using the secondary certificate, instead of the new primary certificate, responsive to determining a fault in the new primary certificate; and
another new primary certificate engine is configured to configure another new primary SSL certificate and secure data communicated between the endpoint and the other endpoint using the other new primary certificate instead of the secondary certificate.