Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow injecting root certificate validity via env and also validity for new certs, when using USE_LOCAL_CA=1 #229

Closed
wants to merge 1 commit into from
Closed

Allow injecting root certificate validity via env and also validity for new certs, when using USE_LOCAL_CA=1 #229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,9 @@ instructions, from `@staticfloat`'s image, can be found
- `CERTBOT_DNS_PROPAGATION_SECONDS`: The number of seconds to wait for the DNS challenge to [propagate](.docs/certbot_authenticators.md#troubleshooting-tips) (default: certbot's default)
- `DEBUG`: Set to `1` to enable debug messages and use the [`nginx-debug`][10] binary (default: `0`)
- `USE_LOCAL_CA`: Set to `1` to enable the use of a [local certificate authority](./docs/advanced_usage.md#local-ca) (default: `0`)
- `LOCAL_CA_DIR`: Set to a path to use as the [local CA directory](./docs/advanced_usage.md#local-ca) (default: `/etc/local_ca`)
- `ROOT_CERT_LOCAL_CA_VALIDITY`: The number of days the [root certificate](./docs/advanced_usage.md#local-ca) should be valid (default: `30` days)
- `NEW_CERT_LOCAL_CA_VALIDITY`: The number of days the [issued certificates](./docs/advanced_usage.md#local-ca) should be valid (default: `30` days)


## Volumes
Expand Down Expand Up @@ -115,6 +118,21 @@ the scripts and Nginx to reload everything.
docker kill --signal=HUP <container_name>
```

Example of how to start the container with a local CA(advanced usage):

```bash
docker run -it -p 80:80 -p 443:443 \
--env [email protected] \
-v $(pwd)/nginx_secrets:/etc/letsencrypt \
-v $(pwd)/user_conf.d:/etc/nginx/user_conf.d:ro \
-v $(pwd)/local_ca:/etc/local_ca_custom:rw \
--env USE_LOCAL_CA=1 \
--env LOCAL_CA_DIR=/etc/local_ca_custom \
--env ROOT_CERT_LOCAL_CA_VALIDITY=3650 \
--env NEW_CERT_LOCAL_CA_VALIDITY=365 \
--name nginx-certbot jonasal/nginx-certbot:latest
```


## Run with `docker-compose`
An example of a [`docker-compose.yaml`](./examples/docker-compose.yml) file can
Expand Down Expand Up @@ -211,4 +229,4 @@ a look and see if one of these helps or inspires you to do something similar:
[13]: https://portforward.com/router.htm
[14]: https://github.com/JonasAlfredsson/docker-nginx-certbot/issues/28
[15]: https://security.stackexchange.com/a/104991
[16]: https://github.com/bats-core/bats-core
[16]: https://github.com/bats-core/bats-core
3 changes: 1 addition & 2 deletions docs/advanced_usage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,8 +198,7 @@ these files. By then taking the `caCert.pem` and [importing][9] it in your
browser you will be able to visit these sites without the error stating that
the certificate is signed by an unknown authority.

> The validity period for the automatically created CA is only 30 days, and the
reason for this is to deter people from using this solution in production.
The validity of the root certificate can be changed(from `30 days` default), by setting the `ROOT_CERT_LOCAL_CA_VALIDITY` environment variable when running the script. The certificates that are signed by the CA will have a validity period of `30 days` by default, but this can be changed by setting the `NEW_CERT_LOCAL_CA_VALIDITY` environment variable when running the script.

An important thing to know is that these files are only created if they do
not exist. What this enables is an even more advanced usecase where you might
Expand Down
3 changes: 3 additions & 0 deletions examples/nginx-certbot.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,3 +14,6 @@ CERTBOT_AUTHENTICATOR=webroot
CERTBOT_DNS_PROPAGATION_SECONDS=""
DEBUG=0
USE_LOCAL_CA=0
LOCAL_CA_DIR=""
ROOT_CERT_LOCAL_CA_VALIDITY=""
NEW_CERT_LOCAL_CA_VALIDITY=""
9 changes: 6 additions & 3 deletions src/scripts/run_local_ca.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,13 @@ LOCAL_CA_DB="${LOCAL_CA_DIR}/index.txt"
LOCAL_CA_SRL="${LOCAL_CA_DIR}/serial.txt"
LOCAL_CA_CRT_DIR="${LOCAL_CA_DIR}/new_certs"

: ${NEW_CERT_LOCAL_CA_VALIDITY:="30"}
: ${ROOT_CERT_LOCAL_CA_VALIDITY:="30"}

# Source in util.sh so we can have our nice tools.
. "$(cd "$(dirname "$0")"; pwd)/util.sh"

info "Starting certificate renewal process with local CA"
info "Starting certificate renewal process with local CA with LOCAL_CA_DIR='${LOCAL_CA_DIR}', NEW_CERT_LOCAL_CA_VALIDITY=${NEW_CERT_LOCAL_CA_VALIDITY} and ROOT_CERT_LOCAL_CA_VALIDITY=${ROOT_CERT_LOCAL_CA_VALIDITY}"

# We require an email to be set here as well, in order to simulate how it would
# be in the real certbot case.
Expand Down Expand Up @@ -44,7 +47,7 @@ certificate = ${LOCAL_CA_CRT}
database = ${LOCAL_CA_DB}
serial = ${LOCAL_CA_SRL}
new_certs_dir = ${LOCAL_CA_CRT_DIR}
default_days = 30
default_days = ${NEW_CERT_LOCAL_CA_VALIDITY}
default_md = sha256
email_in_dn = yes
unique_subject = no
Expand Down Expand Up @@ -128,7 +131,7 @@ generate_ca() {
"emailAddress = ${CERTBOT_EMAIL}" \
) \
-extensions ca_cert \
-days 30 \
-days ${ROOT_CERT_LOCAL_CA_VALIDITY} \
-key "${LOCAL_CA_KEY}" \
-out "${LOCAL_CA_CRT}"
fi
Expand Down