docs/system/tls.rst

7 session data encryption, along with x509 certificates for simple client
10 server, character devices with the TCP backend, NBD server and client,
11 and migration server and client.
25 authentication, then each client will also need to be issued a
86 When connecting the certificate is sent to the client which validates it
89 clients when connecting. The hostname / IP address that the client
92 found the client will close the connection.
150 Issuing client certificates
153 The QEMU x509 TLS credential setup defaults to enabling client
155 mechanism. If this default is used, each client also needs to be issued
156 a certificate. The client certificate contains enough metadata to
157 uniquely identify the client with the scope of the certificate
158 authority. The client certificate would typically include fields for
162 the information for each client, and use it to issue client
167    # cat > client-hostNNN.info <<EOF
177    # certtool --generate-privkey > client-hostNNN-key.pem
181               --load-privkey client-hostNNN-key.pem \
182               --template client-hostNNN.info \
183               --outfile client-hostNNN-cert.pem
188 certificate is intended for usage in a web client. Although QEMU network
194 The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files
195 should now be securely copied to the client for which they were
196 generated, and renamed to ``client-key.pem`` and ``client-cert.pem``
198 ``client-key.pem`` file is security sensitive and should be kept
201 If a single host is going to be using TLS in both a client and server
207 client and server instructions in one.
238 ``client-cert.pem`` and ``client-key.pem``.
252 Note, however, that credentials for use in a client endpoint must be
258 ``server-key.pem``, ``server-cert.pem``, ``client-key.pem`` and
259 ``client-cert.pem`` as appropriate. It is also possible to include a set
266 used for a network client or server, and determines which PEM files are
274 should never be turned off for client endpoints, however, it may be
279 To load server credentials with client certificate validation enabled
285 while to load client credentials use
289    |qemu_system| -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=client
322 When connecting from a qemu-based client you must specify the directory
326      --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rich,endpoint=client \