Red Hat SSL configuration for tog-pegasus
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   The Red Hat tog-pegasus package is built with support for SSL
   (the Secure Socket Layer).
   Note: the upstream documentation for SSL is located here:
   /usr/share/doc/tog-pegasus/PegasusSSLGuidelines.htm
   However, because the upstream documentation for SSL is not up-to-date
   (it was last updated in March, 2006, around the time of the
   OpenPegasus-2.5.1 release), nor accurate, we are providing this short
   description of how to configure SSL, as well as how it should be used.

 Hard-Coded Build-Time Constants:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   Here is the list of constants which are hard-coded during build time:

   PEGASUS_CONFIG_DIR = /etc/Pegasus

   PEGASUS_PEM_DIR = /etc/pki/Pegasus

   PEGASUS_SSL_KEY_FILE = file.pem
   PEGASUS_SSL_KEY_FILE_PATH = $(PEGASUS_PEM_DIR)/$(PEGASUS_SSL_KEY_FILE)
                  (= /etc/pki/Pegasus/file.pem)
   o Contains the private key for the CIM Server SSL Certificate.

   PEGASUS_SSL_CERT_FILE = server.pem
   PEGASUS_SSL_CERT_FILE_PATH = $(PEGASUS_PEM_DIR)/$(PEGASUS_SSL_CERT_FILE)
                             (= /etc/pki/Pegasus/server.pem)
   o Contains the CIM Server SSL Certificate.

   PEGASUS_SSL_TRUSTSTORE = client.pem
   PEGASUS_SSL_CLIENT_TRUSTSTORE = $(PEGASUS_PEM_DIR)/$(PEGASUS_SSL_TRUSTSTORE)
                                (= /etc/pki/Pegasus/client.pem)
   PEGASUS_SSL_SERVER_TRUSTSTORE = $(PEGASUS_PEM_DIR)/cimserver_trust
                                (= /etc/pki/Pegasus/cimserver_trust)
   o Specifies the location of the OpenSSL truststore. Consistent with the
     OpenSSL implementation, a truststore can be either a file or directory.
     If the truststore is a directory, then all certificates within the
     directory are considered trusted.

   PEGASUS_SSL_SERVER_CRL = $(PEGASUS_PEM_DIR)/crl
                         (= /etc/pki/Pegasus/crl)
   o This is where the CRL (Certificate Revocation List) store resides.

 Tips Following Package Installation:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   o CIM Server default SSL certificates are generated when you run the
     tog-pegasus daemon (for example, by issuing the command
     "systemctl start tog-pegasus") for the first time, which includes the
     following files, which are created in /etc/pki/Pegasus: ca.crt, ca.srl,
     client.pem, file.pem, server.pem and in /etc/Pegasus: ssl-ca.cnf,
     ssl-service.cnf.
     Important: simply running the "cimserver" binary (/usr/sbin/cimserver)
     does NOT create the certificates or abovementioned files.
     Note: if you want to use your own certificates, simply overwrite the ones
     in /etc/pki/Pegasus.

   o to enable/disable HTTPS port 5989 (the official WBEM secure port),
     use cimconfig.

   o the wbemcli command (from the sblim-wbemcli package)
     uses /etc/pki/Pegasus/client.pem by default (see man wbemcli).