Skip to main content

Managing SSL Certificates and Multiple Domains in Ceph RGW

Background​

SSL certificates and keys for a Ceph RGW (RADOS Gateway) endpoint are stored in two places:

  • The orchestrator (visible via ceph orch ls --export)
  • The config-key database (accessible via ceph config-key get)

When a service is first deployed using a YAML file, the orchestrator copies the cert and key into the config-key database. RGW fetches them from there at startup. If the cert is subsequently updated directly in the config-key database, the two will be out of sync. To check for this, run:

ceph config-key ls | grep rgw

Look for keys containing cert or key, then retrieve their values with:

ceph config-key get NAME

Updating an Expiring SSL Certificate​

To update an SSL certificate and key, it is best to modify the existing service configuration and redeploy, to ensure consistency between the orchestrator and the config-key database.

  1. Export the current service configuration to a file:

    ceph orch ls --service-name=SERVICE-NAME --export > FILENAME.yaml

  2. Edit the exported file:

    • Replace the existing cert and key with the new ones
    • Ensure the certificate block uses correct YAML formatting — use | instead of ' for the multiline value. See the Ceph RGW HTTPS documentation for the correct format.

  3. Apply the updated configuration (optionally with --dry-run first):

    ceph orch apply -i FILENAME.yaml [--dry-run]

  4. Redeploy the service:

    ceph orch redeploy SERVICE-NAME

Serving Multiple Domains from the Same Backend​

It is possible to serve the same S3 storage under multiple domain names, each with its own valid SSL certificate. This is useful when working with a vanity domain (for example, as provided by the Open Storage Network) in addition to a primary domain.

Each domain requires its own RGW service definition. Both RGWs will access the same backend storage, so end users will get the same data regardless of which domain they use.

Step 1: Create a service definition for each domain​

Create two YAML files, one per domain. Note:

  • Give each a distinct service_id
  • Remove the service_name field — it is not needed
  • Use correct multiline YAML formatting for the certificate block (use |)

[!IMPORTANT]

Make sure that CERTIFICATE appears before PRIVATE KEY. If CERTIFICATE does not appear before PRIVATE KEY, SSL will not work.

<domain1>.yaml

service_type: rgw
service_id: <domain1>
spec:
  rgw_frontend_ssl_certificate: |
    -----BEGIN PRIVATE KEY-----
    <private key>
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    <certificate>
    -----END CERTIFICATE-----
  ssl: true

<domain2>.yaml

service_type: rgw
service_id: <domain2>
spec:
  rgw_frontend_ssl_certificate: |
    -----BEGIN PRIVATE KEY-----
    <private key>
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----
    <certificate>
    -----END CERTIFICATE-----
  ssl: true

Step 2: Apply both service definitions​

ceph orch apply -i <domain1>.yaml
ceph orch apply -i <domain2>.yaml

Step 3: Set the DNS name for each RGW​

This tells each RGW which domain it should serve. Without this step, an error will occur.

ceph config set client.rgw.<domain1> rgw_dns_name <domain1>
ceph config set client.rgw.<domain2> rgw_dns_name <domain2>

After completing these steps, two RGW instances will be running, each serving its corresponding domain, but both accessing the same backend storage.