The SSL Certificates in xCAT
----------------------------


The xCAT daemon on the management node and service node listens on a SSL socket on port 3001, the communications on the SSL socket include:

   1. the xCAT requests from xCAT Clients
   2. the xCAT requests forwarded from other xCAT daemons, for example, the requests forwarded between xCAT daemons on management node and service nodes
   3. some special xCAT requests from compute nodes, such as ``getcredentials``, ``getpostscript``, ``litefile``, etc.

xCAT creates 1 CA certificate and 2 credentials (private key and certificate pairs):

   1. xCAT CA certificate(ca.pem):

      * a self-signed certificate used as Certificate Authority in xcatd SSL communication;
      * generated by ``/opt/xcat/share/xcat/scripts/setup-xcat-ca.sh`` script on xCAT installation;
      * will be generated (or updated) on xCAT management node when:
         * install or update xCAT when "/etc/xcat/ca" directory does not exist
         * or run ``xcatconfig -f|--force``
         * or run ``xcatconfig -c|--credentials``
      * files on management node:
         * ``/etc/xcat/ca/ca-cert.pem``
         * ``/etc/xcat/cert/ca.pem`` ,copied by ``/opt/xcat/share/xcat/scripts/setup-server-cert.sh``
         * ``/root/.xcat/ca.pem`` ,copied by ``/opt/xcat/share/xcat/scripts/setup-local-client.sh``
      * file on service node: ``/root/.xcat/ca.pem``
      * distribution path:
        **/etc/xcat/cert/ca.pem (MN)** ===(run ``xcatconfig`` command)===> **/install/postscripts/_xcat/ca.pem (MN)** ===(node provision/updatenode)==> **/xcatpost/_xcat/ca.pem (SN and CN)** ==(run "servicenode" postscript)==> **/root/.xcat/ca.pem (SN)**

   2. xCAT server credential(server-cred.pem):

      * a concatenation of server private key and certificate(signed with xCAT CA certificate)
      * generated by ``/opt/xcat/share/xcat/scripts/setup-server-cert.sh`` on xCAT installation;
      * will be generated (or updated) on xCAT management node when:
         * install or update xCAT when ``/etc/xcat/cert`` directory does not exist
         * or run ``xcatconfig -f|--force``
         * or run ``xcatconfig -c|--credentials``
      * file on management node: ``/etc/xcat/cert/server-cred.pem``
      * file on service node: ``/etc/xcat/cert/server-cred.pem``
      * distribution path:
        **/etc/xcat/cert/server-cred.pem (MN)** ==(run ``xcatserver`` script called by ``servicenode`` postscript)===> **/etc/xcat/cert/server-cred.pem(SN)**

   3. xCAT client credential(client-cred.pem):

      * a concatenation of client private key and certificate (signed with xCAT CA certificate)
      * generated by ``/opt/xcat/share/xcat/scripts/setup-local-client.sh`` on xCAT installation
      * will be generated (or updated) on xCAT management node when:
         * install or update xCAT when ``/root/.xcat/client-key.pem``  does not exist;
         * or run ``xcatconfig -f|--force``
         * or run ``xcatconfig -c|--credentials``
      * file on management node: ``/root/.xcat/client-cred.pem``
      * file on service node: ``/root/.xcat/client-cred.pem``
      * distribution path:
        **/root/.xcat/client-cred.pem (MN)** ===(run ``xcatclient`` script called by ``servicenode`` postscript")===> **/root/.xcat/client-cred.pem(SN)**

The usage of the credentials in the xCAT SSL communication is:

          .. image:: ./imgs/certs.png
             :height: 500 px
             :width:  600 px
             :scale: 100 %
             :alt: alternate text
             :align: center

