13.2. Remote management over TLS and SSL
You can manage virtual machines using TLS and SSL. TLS and SSL provides greater scalability but is more complicated than ssh (refer to
Section 13.1, “Remote management with SSH”). TLS and SSL is the same technology used by web browsers for secure connections. The
libvirt
management connection opens a TCP port for incoming connections, which is securely encrypted and authenticated based on x509 certificates. In addition the VNC console for each guest virtual machine will be setup to use TLS with x509 certificate authentication.
This method does not require shell accounts on the remote machines being managed. However, extra firewall rules are needed to access the management service or VNC console. Certificate revocation lists can revoke users' access.
To enable SSL and TLS for VNC, it is necessary to put the certificate authority and client certificates into $HOME/.pki
, that is the following three files: