fixca - FIX Internal Certificate Authority

Introduction

FIX CA is the internal Certificate Authority for FIX. It provides the same interface as Fix Core's built-in CA and is used to issue certificates for FIX internal services.

FIX CA stores its CA cert and key in a K8s secret. As such it needs to either run inside a K8s cluster with appropriate permissions or have access to a K8s cluster via KUBECONFIG.

The API is fully compatible with Resoto Core's CA API. I.e. /ca/cert to download the CA cert and /ca/sign to sign a CSR. Other than Resoto Core JWT authentication can not be turned off and a pre-shared-key is mandatory to sign a CSR.

Usage

usage: fixca [-h] [--psk PSK] [--port PORT] [--namespace NAMESPACE] [--secret SECRET]
[--verbose | --trace | --quiet]
FIX Certification Authority
options:
-h, --help show this help message and exit
--psk PSK Pre-shared-key
--port PORT HTTPS port to listen on (default: 7900)
--namespace NAMESPACE
K8s namespace (default: fix)
--secret SECRET Secret name (default: fix-ca)
--verbose, -v Verbose logging
--trace Trage logging
--quiet Only log errors

Alternatively export the following environment variables:

• FIXCA_PSK
• FIXCA_PORT
• FIXCA_NAMESPACE
• FIXCA_SECRET

Only the pre-shared-key is mandatory. The other options have sensible defaults.

K8s cluster issuer

When using cert-manager to issue certificates for your services you can use the following cluster issuer:

apiVersion: cert-manager.io/v1kind: ClusterIssuermetadata:
name: fix-ca-issuernamespace: cert-managerspec:
ca:
secretName: fix-ca

Example Certificate

apiVersion: cert-manager.io/v1kind: Certificatemetadata:
name: lukas-test-certnamespace: fixspec:
secretName: lukas-testduration: 2160h# 90drenewBefore: 360h# 15dcommonName: lukas.testprivateKey:
algorithm: RSAencoding: PKCS1size: 2048usages:
- server auth
- client authdnsNames:
- redis.fixissuerRef:
name: fix-ca-issuergroup: cert-manager.iokind: ClusterIssuer

Check the cert-manager documentation for more information.