[RORDEV-2145] PKI authentication example

README.md

@@ -62,6 +62,7 @@ To stop and clean up:
 | [basic-multitenancy](examples/basic-multitenancy) | Multi-tenancy: isolated Kibana spaces and index access per user |
 | [kibana-reverse-proxy](examples/kibana-reverse-proxy) | Two Kibana nodes behind an Apache HTTPS reverse proxy with sticky-session load balancing, SSL termination, and a configurable base-path rewriting strategy |
 | [fleet](examples/fleet) | Full Elastic Fleet stack: Fleet Server, Elastic Agent with APM, and an instrumented Node.js service, all secured with ReadonlyREST |
+| [pki-auth](examples/pki-auth) | Services authenticating with a TLS client certificate instead of a password, with the username and groups read from the certificate |
 
 ## Project structure
 

examples/pki-auth/.env

@@ -0,0 +1,25 @@
+# PKI authentication is not in a released ReadonlyREST yet, so the plugin ships with this repository
+# rather than being downloaded. The zip lives in runner/plugins/ because the Docker build context is
+# runner/ - ROR_ES_FILE is a COPY source and has to be relative to it.
+#
+# Rebuild it from the elasticsearch-readonlyrest-plugin repository with:
+#   ./gradlew clean buildRorPlugin '-PesVersion=9.5.0'
+ROR_MIN_LICENSE_EDITION=FREE
+
+# 9.5.0 is the version this build was verified against by the PKI integration suites.
+# Only the es94x module implements PKI so far; it covers ES 9.4.x and 9.5.0.
+ES_VERSION=9.5.0
+ROR_ES_PLUGIN_SOURCE=LOCAL_FILE
+ROR_ES_FILE=plugins/readonlyrest-1.71.0-pre7_es9.5.0.zip
+
+# Kibana is here so a human can log in with a password while the services authenticate by certificate
+# on the same port. PKI itself is demonstrated with curl - certificates are for machine-to-machine
+# traffic, and Kibana never presents one.
+#
+# NOTE: the Elasticsearch plugin is the local pre-release above while the Kibana plugin is downloaded,
+# so the two ReadonlyREST versions differ. If Kibana cannot talk to Elasticsearch, align them - either
+# point ROR_KBN_VERSION at a matching release or switch to LOCAL_FILE with ROR_KBN_FILE.
+KBN_INSTANCES=1
+KBN_VERSION=9.5.0
+ROR_KBN_PLUGIN_SOURCE=API
+ROR_KBN_VERSION=1.70.3

examples/pki-auth/README.md

@@ -0,0 +1,120 @@
+# PKI Auth Example
+
+Demonstrates authenticating services by their TLS client certificate: ReadonlyREST derives the username and groups from the certificate, while password-based users share the same port.
+
+## Users
+
+| Identity        | Credential                                       | Group    | Kibana access | Access to `logs-*` |
+|-----------------|--------------------------------------------------|----------|---------------|--------------------|
+| `svc-logstash`  | Certificate `CN=svc-logstash,OU=ingest,OU=Services` | `ingest` | None          | Write              |
+| `svc-dashboard` | Certificate `CN=svc-dashboard,OU=query,OU=Services` | `query`  | None          | Read               |
+| `jsmith`        | Certificate `CN=jsmith,OU=ingest,OU=People`      | —        | None          | Refused            |
+| `analyst`       | Password `analyst`                               | —        | Read-only     | Read               |
+
+The three certificates come from the same CA. None of the services holds a password.
+
+`jsmith` is refused even though the node trusts that certificate and it carries the same `ingest` role, because the certificate is issued into the People branch and the PKI provider declares `subject_dn_base: "OU=Services,DC=corp,DC=example,DC=com"`. One corporate CA usually issues to more than one population, and without that constraint a `CN` extractor would authenticate humans as services.
+
+## How to run
+
+```bash
+curl -sL https://raw.githubusercontent.com/beshu-tech/readonlyrest-examples/master/quickstart.sh | bash -s pki-auth
+```
+
+From a local clone it is just `./run.sh pki-auth`.
+
+Access points after startup:
+
+| Entry point   | URL                      |
+|---------------|--------------------------|
+| Elasticsearch | https://localhost:19200  |
+| Kibana        | https://localhost:15601  |
+
+## What to explore
+
+Run these from the example directory. No credential is passed other than the certificate.
+
+- Write as `svc-logstash`, authenticated by certificate alone:
+
+  ```bash
+  curl -sk --cert certs/svc-logstash.crt --key certs/svc-logstash.key \
+       -XPOST https://localhost:19200/logs-2026/_doc \
+       -H 'Content-Type: application/json' -d '{"msg":"hello"}'
+  ```
+
+- Read with the same certificate — forbidden, because the `ingest` group only grants writes:
+
+  ```bash
+  curl -sk --cert certs/svc-logstash.crt --key certs/svc-logstash.key https://localhost:19200/logs-2026/_search
+  ```
+
+- Read as `svc-dashboard` — a different certificate, a different group, reads allowed:
+
+  ```bash
+  curl -sk --cert certs/svc-dashboard.crt --key certs/svc-dashboard.key https://localhost:19200/logs-2026/_search
+  ```
+
+- Try `jsmith` — trusted by the same CA, but refused for being outside `subject_dn_base`:
+
+  ```bash
+  curl -sk --cert certs/jsmith.crt --key certs/jsmith.key https://localhost:19200/logs-2026/_search
+  ```
+
+- Send no certificate at all — the request falls through to the password block on the very same port:
+
+  ```bash
+  curl -sk -u analyst:analyst https://localhost:19200/logs-2026/_search
+  ```
+
+- Watch a real client do the same thing. A Logstash container ships to `logs-2026` using the `svc-logstash` certificate and no password at all — its config holds no credential other than the certificate ([`confs/logstash.conf`](confs/logstash.conf)). It reports every event it sends:
+
+  ```bash
+  docker logs -f $(docker ps -qf name=logstash)
+  ```
+
+- Watch the data arrive, reading with a *different* certificate. Run this twice a few seconds apart — the count goes up:
+
+  ```bash
+  curl -sk --cert certs/svc-dashboard.crt --key certs/svc-dashboard.key \
+       'https://localhost:19200/logs-2026/_count'
+  ```
+
+  That is the whole point in one line: `svc-logstash` wrote it and cannot read it back, `svc-dashboard` reads it and cannot write, and neither of them holds a password.
+
+- Log in to Kibana as `analyst:analyst`. A browser never presents a client certificate, so Kibana authenticates with a password on the same port the services use certificates on.
+
+## How it is configured
+
+The node asks for a certificate and verifies it ([`confs/elasticsearch.yml`](confs/elasticsearch.yml)):
+
+```yaml
+xpack.security.http.ssl.client_authentication: optional
+xpack.security.http.ssl.verification_mode: certificate
+xpack.security.http.ssl.certificate_authorities: [ "ca.crt", "pki-ca.crt" ]
+```
+
+`optional` rather than `required`, so a caller without a certificate still reaches the ACL and can fall through to the password block. `required` would reject it during the handshake instead, and `analyst` would never get in.
+
+ReadonlyREST turns the certificate into a user ([`confs/readonlyrest.yml`](confs/readonlyrest.yml)):
+
+```yaml
+pkis:
+  - name: corporate_pki
+    subject_dn_base: "OU=Services,DC=corp,DC=example,DC=com"
+    issuer_dn: "CN=Corp Issuing CA,DC=corp,DC=example,DC=com"
+    users:
+      user_id_attribute: "CN"
+    groups:
+      group_id_attribute: "OU"
+```
+
+The groups it reads are *external* groups, mapped to local ones in the `users` section. Every certificate here carries two OUs — `OU=ingest` names a role, `OU=Services` merely places it in the corporate tree — and only the role is mapped. The other is discarded.
+
+The certificates are generated by [`certs/generate.sh`](certs/generate.sh), which you can rerun. The distinguished names are part of the configuration: change them and `confs/readonlyrest.yml` has to change with them.
+
+## Things to check in your own cluster
+
+- **TLS must terminate at Elasticsearch.** If a load balancer, ingress or service mesh terminates it upstream, no certificate ever reaches the node and PKI rules never match. This is the most common reason PKI appears not to work.
+- **Kibana cannot use PKI.** A browser presents no client certificate, so anything reaching Elasticsearch through Kibana authenticates as Kibana's own service account. Keep a password or SSO path for people.
+- **Never set `verification_mode: none`.** The node would still ask for a certificate and then validate nothing, so anyone able to run a CA could issue one saying `CN=svc-logstash` and be authenticated as that service. ReadonlyREST cannot detect this, and `issuer_dn` is no defence: the issuer name is read off the certificate that was presented, so a self-signed one can simply claim `CN=Corp Issuing CA` as well. `issuer_dn` narrows which of several *trusted* CAs an identity may come from; it is not a substitute for validating the chain.
+- **Order your blocks.** If a request carries both a certificate and an `Authorization` header, the first matching block decides the identity. Put password blocks for known service accounts above the PKI blocks.

examples/pki-auth/certs/generate.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+#
+# Regenerates the CA and the client certificates this example authenticates with.
+#
+# The distinguished names are the whole point: ReadonlyREST reads the username out of CN and the groups
+# out of OU, so these names and confs/readonlyrest.yml have to stay in step.
+#
+#   CN=svc-logstash, OU=ingest,  OU=Services  -> user svc-logstash, external group 'ingest'
+#   CN=svc-dashboard,OU=query,   OU=Services  -> user svc-dashboard, external group 'query'
+#   CN=jsmith,       OU=ingest,  OU=People    -> rejected: outside the provider's subject_dn_base
+#
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+DAYS=3650
+BASE_DN="/DC=com/DC=example/DC=corp"
+
+rm -f ./*.crt ./*.key ./*.csr ./*.srl
+
+echo "==> certificate authority"
+openssl req -x509 -newkey rsa:2048 -nodes -days "$DAYS" \
+  -keyout pki-ca.key -out pki-ca.crt \
+  -subj "${BASE_DN}/CN=Corp Issuing CA" 2>/dev/null
+
+new_client() {
+  local name="$1" subject="$2"
+  openssl req -newkey rsa:2048 -nodes \
+    -keyout "${name}.key" -out "${name}.csr" \
+    -subj "${subject}" 2>/dev/null
+  openssl x509 -req -in "${name}.csr" -days "$DAYS" \
+    -CA pki-ca.crt -CAkey pki-ca.key -CAcreateserial \
+    -out "${name}.crt" 2>/dev/null
+  rm -f "${name}.csr"
+  echo "    ${name}: $(openssl x509 -in "${name}.crt" -noout -subject | sed 's/^subject=//')"
+}
+
+echo "==> client certificates"
+# openssl appends the RDNs in the order given and a DN prints right to left, so OU=Services - written
+# here *before* OU=ingest - is the one that ends up rightmost, next to the DC components. That suffix
+# is what subject_dn_base matches against, so swapping the two OUs would silently break authentication.
+new_client "svc-logstash"  "${BASE_DN}/OU=Services/OU=ingest/CN=svc-logstash"
+new_client "svc-dashboard" "${BASE_DN}/OU=Services/OU=query/CN=svc-dashboard"
+new_client "jsmith"        "${BASE_DN}/OU=People/OU=ingest/CN=jsmith"
+
+rm -f ./*.srl
+echo
+echo "==> done. Keep pki-ca.crt next to elasticsearch.yml so the node trusts these certificates."

examples/pki-auth/certs/jsmith.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDUTCCAjkCCQDK6IB8UlwONjANBgkqhkiG9w0BAQsFADBeMRMwEQYKCZImiZPy
+LGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEUMBIGCgmSJomT8ixk
+ARkWBGNvcnAxGDAWBgNVBAMMD0NvcnAgSXNzdWluZyBDQTAeFw0yNjA4MDYxNzM5
+MTVaFw0zNjA4MDMxNzM5MTVaMHcxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
+kiaJk/IsZAEZFgdleGFtcGxlMRQwEgYKCZImiZPyLGQBGRYEY29ycDEPMA0GA1UE
+CwwGUGVvcGxlMQ8wDQYDVQQLDAZpbmdlc3QxDzANBgNVBAMMBmpzbWl0aDCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxnAcCT8KpTHoRwUyHoD/5toWHo
+hDXe3q/jLvKfmG7VmgorP3bhlqEeT/Pbr2g+rJ3sWDuMcXuAkp7XggwtPJWlUvsL
+zG55Ugw2Mwgm8pEJwerL7qyYhtCA/Ce5cJNOE1L75lI2phN8BPFqnmGLBAHlStYL
+4q4/dUUMgAxD9RVSpyJVgISKuxVR15BQsFh/KIZrc4PvdFUQSY9W4cid4HmY/yMb
+rk9UBCMNm8aTvprrM7o6dUmuMr0e/aYrytrHVI2DRb82y4+e8EfZOT7Uu81Kx112
+2lt0Q/EkZO2hV5wsYyy5X3NqkxKdGDWT22/IpvqMRWnSFaUG/JHIdChVcUkCAwEA
+ATANBgkqhkiG9w0BAQsFAAOCAQEAnX01YsjlM0lrZ2MkfUuQdUXfqFePVFTCWVSG
+pCcU9500BXoCAdXJuOg8ZDhrve3ZJxy36wUH1XdLqjdLaVtSq0gwXs8zOqLQwbot
+6FeRuP89ojMHGnYEiSPfzoyIxhkAxo361FsIhmC34co1bh30sbnyIODrfiIWZtUV
+44kRZtQJWuZs5EmmYQ8c88BidEuNUeiSYuyH30bT7ErEjouxE/7yo75Vhjzkm9rP
+Ixc/SOAHLO211yv3nNpY3ha9jy8XyiazKwnqDrb66faCrkm9V9EradEXcygVjcDm
+oIPyKhru1oEk++f1vOwXezVaqLNqB62q4mPukqSPWib7mFof0A==
+-----END CERTIFICATE-----

examples/pki-auth/certs/jsmith.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDMZwHAk/CqUx6E
+cFMh6A/+baFh6IQ13t6v4y7yn5hu1ZoKKz924ZahHk/z269oPqyd7Fg7jHF7gJKe
+14IMLTyVpVL7C8xueVIMNjMIJvKRCcHqy+6smIbQgPwnuXCTThNS++ZSNqYTfATx
+ap5hiwQB5UrWC+KuP3VFDIAMQ/UVUqciVYCEirsVUdeQULBYfyiGa3OD73RVEEmP
+VuHIneB5mP8jG65PVAQjDZvGk76a6zO6OnVJrjK9Hv2mK8rax1SNg0W/NsuPnvBH
+2Tk+1LvNSsdddtpbdEPxJGTtoVecLGMsuV9zapMSnRg1k9tvyKb6jEVp0hWlBvyR
+yHQoVXFJAgMBAAECggEARsh5A953XhRQoh5fu4MoXrxKQaSKfDlEtnYe4OhBmkgg
+Att9K8btKbhciZ8O/DOQBVQ+Lcjx14nrvFP29g6IR24r8UHhtnQO5Km0PGN4Zp+R
+ZqTebyiWrwerynneMTS9XmRbGydPlbnB4HRCipbgeWOU6dDN2/efvZyZjyXNbmdF
+ZCyjon/B5JjKKJE5OFvAU5XdJQlCTPPLiqm2VxV96JrY0cK7eehGiKa2BJ9BjxJJ
+0xAxGtepu3GB7CrN8UPgqk1UXZ8PRpoJkTySf4tvf/oo0gjNX/UqNWLemS8x/GOk
+TORlm7SSBOrs7AyezDJbgNRR8Hjv+fykHbV9DDsCHQKBgQDus1ojr67u5dtuwXfV
+vqwiPsc7Kw5PAL+92wlTP/7R1vS8vBE9VjqemuQYQ9QUp0aDolPHgLrSJ6hsol6z
+v9QzG/pJAQHlkQQVXwxK2Lm8o+n2t4p7bGudni4qnvU2BqE4OLmLq6nXao4ca5aH
+mmZ2beVsyHS036Nj0+Dvchq2kwKBgQDbN1CNLRM+6RQsq5H2HhgYe2Rd8dIYL41O
+O/zH0N8pXiy4YndV/sxk7HBSdiJw4ebNHOXgRiCuwM8+7w9tQuINsK5CnKqVgRDo
+7Wa0FHBaJD/m+Bdat7upZbVVgLliHy/E8SBXh5zX1vkF7hc9SW49doLU6+pw23If
+yECqyPnmMwKBgQCwdHc7EEFSKytmmbB7muNmwV/IVpDSSCx2LfibySAXgT8UUjaw
+UBEvdDMP2PxrdCjFYHdscLYqatSv0ewOFs3IJnOECjGbwfLx1Xyhy8qqL8Xh81Z0
+3PZE400fhriggpAlnpFTNchtDUEWs1Xo0nPSMnU6UIktuHDxeAy9FW237wKBgBiR
+hXydDagiVTmAbRZpXwf3ZFNHE+XUBoE7JeR7G1e2j0qG9przuJKjER+cz9VY7BYW
+5AiTs3wCbfe+sTrsoQspvw4GIvQoh+2jFbyfAcyIfYT0TyHCr8yXcpBHof9GQYNQ
+BvDoaQKjvDsW6RHcVfebfaRBYIAPiCXZuq2pYqCTAoGBAK248EhDBP8/n+CRPimh
+ddHyvhLdv41hl9nmqfj6lkFxdY36BOyv8kxMV9bTEm1CULuoQzCcoRRTxm+n/v7v
+wAT2QWsNDHg0cOdUp1JhU0pIVmFduNsNKkDOsceBmGDb55Rq1Zx2gijiuCzJbGgx
+xD3vbwWa2ePI4hQT3pBWTKcn
+-----END PRIVATE KEY-----

examples/pki-auth/certs/pki-ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDODCCAiACCQCW5hO8JQvyRzANBgkqhkiG9w0BAQsFADBeMRMwEQYKCZImiZPy
+LGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEUMBIGCgmSJomT8ixk
+ARkWBGNvcnAxGDAWBgNVBAMMD0NvcnAgSXNzdWluZyBDQTAeFw0yNjA4MDYxNzM5
+MTVaFw0zNjA4MDMxNzM5MTVaMF4xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
+kiaJk/IsZAEZFgdleGFtcGxlMRQwEgYKCZImiZPyLGQBGRYEY29ycDEYMBYGA1UE
+AwwPQ29ycCBJc3N1aW5nIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAwhielJvlb/BVlseFdDHGtwNwzdEiCQxcSAtzkGsVr8sH0TikoIaCTJmABIu1
+Mc66IHhvPV56wmqCWRGNU6I2n2a3g3RkMfwPGMu12U5Du7x+MX81Zd0G4rmEylYX
+DO39Jh71wBX+lDUjuXYpL+11vvayy0uwqletsyrjtwBj85HL3EpCzUyQ3MRBiYoq
+1ux9TFqf0e7Pj4xdgXT2Z8jJ3t6SnTOOcQYnWS9te1ooCZZ0QnHG8oWs0dnqw8OF
+I0d27oo94WFdtvEgKoqlDaRlTj3SWyc3dTRn5yc/JZmN5DR4z6J6WGu/Hm4fzJe5
+/1Za2HxnilKPMlUj3RUFlTkU+wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBmcoBC
+bkvTUmFHIg1NzYx8ZsSu/T3ZZApfoaXFA2WISKbckhvDiW5dSX8haKOthb095yeA
+aPfxKYmursaFF4ZRoGeeeIVHCWanaZF9U/OpcmcahFnTG6Bg0qw7KNxPNhEcOdRP
+H91tJrbnm8S6TlYBH8RxpqoyXq+2dN3+OK++zzWoUldf7a77U9Jw7W6YFdcAq2g5
+6+RmO9tJtGOpyUTgJ2kGJ5SoLktReWU4cw3qtUgvVkvxTchVsURzvopSIfHXAHbB
+JQmY+FozFQfD4O/Bo74QYYJwURFkbWXk6BHoR6orOwueDgBomT+U7iUInBFwnSxj
+ZxdgaSLCZLrrmmw3
+-----END CERTIFICATE-----

examples/pki-auth/certs/pki-ca.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDCGJ6Um+Vv8FWW
+x4V0Mca3A3DN0SIJDFxIC3OQaxWvywfROKSghoJMmYAEi7UxzrogeG89XnrCaoJZ
+EY1TojafZreDdGQx/A8Yy7XZTkO7vH4xfzVl3QbiuYTKVhcM7f0mHvXAFf6UNSO5
+dikv7XW+9rLLS7CqV62zKuO3AGPzkcvcSkLNTJDcxEGJiirW7H1MWp/R7s+PjF2B
+dPZnyMne3pKdM45xBidZL217WigJlnRCccbyhazR2erDw4UjR3buij3hYV228SAq
+iqUNpGVOPdJbJzd1NGfnJz8lmY3kNHjPonpYa78ebh/Ml7n/VlrYfGeKUo8yVSPd
+FQWVORT7AgMBAAECggEAX0sXEH85tiuY2d47d0C4/0GBMIts2mRnKjf1FQJ+M0DL
+Jb1ZljZz4oe6goDVBQ8p8qcudkLconcIaBJmAJmzl68mijOqvZ+zCcl6DqaOOq3g
+hwydetV5e/b5ax25U2/EyeKJZTVnN/ye/X812YIMPSWBwq32nqtNbJmyEzbt27bt
+NhOoKtz2GXlr+pN2e3fvDsMm4eDOqFh/qMiha3eOv2yKoPnKJFuVjANwTC6ziamb
+p77VNvi5xUnpCvlV9keL6rpZhy2i7yaNB7IgSdaFrfl/jaSAG/BnhTgUbvhkOjbL
+djOw/SmIIWoKGzd74JHp0RwYG0wuK7jV9ESiOyZ0AQKBgQD04nTqkAbVJqH+RmLV
+cVIHlwuFfjTTsSBTixGsfkTAXrLGpsyrayMaNeTSVFQ1v2cW+I48nq7igUP5lYtB
+Zs16Z/sbdd96ZkTkp9E3N67X1oj+w4L02Hu2ELnOsOyA1nXulZM4wf6nbAqXcb6U
+So+5oiobikPP0tP7ID9dk/Wu2wKBgQDK6AEmWX39+8VKW/tHh5rin6aDTzW3DdkS
+OgugD8L4IeEeePn0/Kz/VDr6P5md0szrWDC1TwScwdpxVSeUs7ZvtsGC5q03fGNy
+hKP6qVmdN43D4K3z7/iy8EXFsMlp1aUI6f6mZvylCjVbwhNk6PyFsP3S4RbyW4Ci
+9/HdePu8YQKBgDbovDyINPAAbJxeXfTsJu+Kv8ucA+5frhbtfPYHjhTwZvfCGOxq
+5oEPCpLa09MFavEspIAVOLOTNpG1JXdxvKswu45pvMVuPw5iTrgp5SuCcE9nuWp7
+TCoD0BX3d+BftivcIBm+7gHOaQWSPKB1o4qFQRnRw+jKpjuN/IdYEOO3AoGBAJWS
+1x4lBFqRGUuKaL6++O8sTzwmzOsHG0hzX5R7afcuSlwDRAdTqFeECQHmlmAgQA0Q
+8r8E49qGkHfRFR9qJwdNCnNrhq8LU+fcXWDvK+9YP3nwi2ryMDwAIP7tJlyNMF5U
+1/JkosMqtlDQzSkrEtOeuE2WviqkRzxbWIExqSihAoGBAMyY9o4Us6h2T14yjSyP
+C8fhMK9aESfZgZ2CZql+uvIh1WEyUVVY2rok3TThSb5/PYqylgd3erIdRzUIs03+
+P3gyTaMN1AhpXOA3ekYV6IJZOm+1bhoesh/WgYnpaHjzg/Ui1JsfIRezFC5PJP1X
+VfYNegQN9kL6CI4ABFIceD5Y
+-----END PRIVATE KEY-----

examples/pki-auth/certs/svc-dashboard.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWTCCAkECCQDK6IB8UlwONTANBgkqhkiG9w0BAQsFADBeMRMwEQYKCZImiZPy
+LGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEUMBIGCgmSJomT8ixk
+ARkWBGNvcnAxGDAWBgNVBAMMD0NvcnAgSXNzdWluZyBDQTAeFw0yNjA4MDYxNzM5
+MTVaFw0zNjA4MDMxNzM5MTVaMH8xEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ
+kiaJk/IsZAEZFgdleGFtcGxlMRQwEgYKCZImiZPyLGQBGRYEY29ycDERMA8GA1UE
+CwwIU2VydmljZXMxDjAMBgNVBAsMBXF1ZXJ5MRYwFAYDVQQDDA1zdmMtZGFzaGJv
+YXJkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7jgmyq5qF0UbmCTI
+dXa1rsaKrE7CuH4RRFRGaln0da0HQ9wsS7SeJgNP3Tpl1ODPQ6OR+6xiEzwptccd
+GH6+0Ej5dCGezGCnD/yRnBHRqmZm8fWxPqq+jm1727YWZBgkwJcq7LRP8IrfpJgi
+u9yt1I3AnvWHEs0zwuKXR/xJkWXgm3PCFud2vns9aU5y1qQiNTA4GfJc5twGb95p
+ALmdsbSJUY80bf8F4YxhQFwY/4OVrtLUIGNYNp3Fh4n/vWZBBSh6is2QhPw/Evw6
+TplMy2S8EFIl/YZ2q+l1cF8bvmLo3hy216GynssR2KKpZBtmM0Zt+HpqKdmJKctM
+7Qp48wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAW6LbZ9/shMROyXUeWereCE4iO
+zW5+JzwoqlhNlheGfTmfmA8QTNk1TuxoX6sKe6eAEVuOXaw6aQ0USAT/TYHkUM0x
+fwoqeVWKhkq0ziHIFPEcX7Gbf67lelvsQyz6js2mNA5XR79wSLeUGaHAupc9QqWa
+qoibqwPKXx/yrEGBgS13T3pcQrouqAfe5/KlVTe6zrT4VdCvvch77BiXOAscCEB4
+v1oKiKSi2234GionjCfsCNlRRVoYzcdI5cqTCqociSHqMUncnHGVyGhviFzjOZ+a
+Pao5Zh9oj0h6ggqec+6gDYBeZLsW65mlIIyLlhruAbosvewDAquGz0a4K+jB
+-----END CERTIFICATE-----

examples/pki-auth/certs/svc-dashboard.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDuOCbKrmoXRRuY
+JMh1drWuxoqsTsK4fhFEVEZqWfR1rQdD3CxLtJ4mA0/dOmXU4M9Do5H7rGITPCm1
+xx0Yfr7QSPl0IZ7MYKcP/JGcEdGqZmbx9bE+qr6ObXvbthZkGCTAlyrstE/wit+k
+mCK73K3UjcCe9YcSzTPC4pdH/EmRZeCbc8IW53a+ez1pTnLWpCI1MDgZ8lzm3AZv
+3mkAuZ2xtIlRjzRt/wXhjGFAXBj/g5Wu0tQgY1g2ncWHif+9ZkEFKHqKzZCE/D8S
+/DpOmUzLZLwQUiX9hnar6XVwXxu+YujeHLbXobKeyxHYoqlkG2YzRm34emop2Ykp
+y0ztCnjzAgMBAAECggEAfkwy9N5HzRKMsLs/tFc9t+33c6dGQX5FNU7hDl2m6ATW
+hzniGjkmZ8z1uLrPZm/SM3AzY5VfYgdRrdhlKql4DQHDj7iLcpwDtswXfwFLgeZM
+yheS40CvSt/s/O2rLWJHifwbe+eVQli+fYtTTvqPBtQovZ47ANLekIKF5lpxvq2Y
+zMjisl2tz1rNaO2Nw3op3nA5C8gQvVVpIdtQfAAkx6ub0jCFLs5FzPonaS4TJAJ7
+/1yum9VDRZhxfzYonWFLMYAFybix1VSmaWy3Ek0RIPFUOd4KpHNfdGWa2scZoeuX
+r8igz4tCg5or64oRARp8xtHe6hRVU1y3Sq2uUE0/kQKBgQD+4jipwZYH/lh0CY7m
+IVAI2xiOhU/Ld2lJO655EvS3X4SWCcAiyz6AilCdvVsbVreFNgCQc7B6QYRd0R2g
+YTup+we55gSokTayS/Q99OyCdyIvQMitB81+5x8cRo9Zb2WRxwXqTRKBWkddEyBm
+GIme9mNbZ3tZRml+WCdd9uuuTQKBgQDvQz71psIsNkuguIICUc4wAr1aL4bJr2n3
+z/e/itwaNMW5zHwgmOXiuab59t963cnteevng9LGp31KAiMMxVle+taYDJuNrqxe
+a0PO6cmHXvRemyZ5wH9tJ0ocVRNJ8P9coqWRJCHeiUAluKjZ5fFAIhBIdFsnDYll
+sn8/3AbkPwKBgQC79IZkaGUCsAT6TLIb8iTa4vZQ4u3c1MnHP0OB9QCQ2Nck7TvK
+bKZCk7yvFZvBpUjf6tqvqyBQh0/c/wAh7JHa30rrQzvcMnlrMaeCqMJf0wpaXiOd
+tUtMcZL3fvDmusbjoSgzh3JGARTvBdO2dhHGL1tFZCIJy2qvyMH/AL77YQKBgQDf
+0syHCSUELxa4l2InwVddWnLAd01kRxCenpJpQQF+EngVw9EqvV3wpzQpCmUtj2Vj
+Hncs8QiwheaS4UTgoY1laMpvGvw5onnlKfsZCWNZm96G0iVAKHAMMIEH2B5fQW/h
+vNWd3WtBvqufngt3K8Bv+m25GgBbnDI4TK71kmNwCQKBgQD4A9UxJ+eXd6gifQJY
+OWUlwAoftyjNQGckb6AJvAoYrBcKLut4K1VaCj8PKp2dRmNo1R+8X9iwWcXa+nul
+9buL29O+fvC+NVublD/47R2kSb5cQyFGDAkYcyVM2rPFbrugusn4FFUbvTRwBCnF
+28Krv3jm3Nkag8Q4K+9lbvQZbQ==
+-----END PRIVATE KEY-----