Add support for SSL certificate generation

Add support to request SSL certificates from Vault’s PKI backend. Certificates can be issued on demand by using a role.

The generated certificate and the issuing CA certificate need to be stored in a Truststore (Keystore) and the private key in a Keystore. Vault should be used as intermediate CA, so the Truststore should contain the Root CA certificate that should be configured along the certificate request properties.

Config parameters for requesting certificates:

• common-name
• alt-names
• ip-sans

Other required parameters:

• Root certificate

Challenges:

• Public key pinning: Preserve the generated certificate/key pair during its validity period. This is to prevent multiple apps running behind a common endpoint address to use different certificates.

[mp911de]

Created showcase in mp911de/spring-cloud-vault-config, Branch issue/18-ssl-certificate-generation

[bendem]

For the sake of the argument, what is wrong with having multiple upstreams use multiple certificates as long as they are valid?

If you terminate the TLS connection at the loadbalancer, the client never sees the upstream cert and the load balancer has at least one connection (thus one handshake) per upstream, I don’t see a problem here.

If you don’t terminate the TLS connection, I can see the problem happening if you don’t have sticky connections, if you have sticky connections, clients will be just fine so long as the upstream pool doesn’t change too often.

Is the non TLS-terminating loadbalancer without sticky connection a large enough use case that it should prevent other use cases from being met? Also, considering this, the implementation will be much much simpler (start, request certificate, renew, stop[, revoke]).

Maybe I’m missing something obvious here.