Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure old ssl certs not copied in nginx role #149

Merged
merged 17 commits into from
Dec 4, 2024
Merged

Ensure old ssl certs not copied in nginx role #149

merged 17 commits into from
Dec 4, 2024

Conversation

ruaridhg
Copy link
Contributor

@ruaridhg ruaridhg commented Nov 28, 2024 •
edited
Loading

Fixes #145

Checks if ssl certificates exist on server and in cache and copies ssl certificates based on existence and expiry dates:

  • Copy from cache to server if ssl cert doesn't exist on server
  • Copy from server to cache if ssl cert doesn't exist in cache
  • Copy from cache to server if ssl cert on server expires sooner
  • Copy from server to cache if ssl cert in cache expires sooner

@ruaridhg ruaridhg linked an issue Nov 28, 2024 that may be closed by this pull request
SSL certificates get overwritten in nginx role #145
Closed
@ruaridhg ruaridhg requested a review from a team November 28, 2024 17:10
drmatthews
drmatthews requested changes Nov 28, 2024
View reviewed changes
Copy link
Contributor

@drmatthews drmatthews left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately I don't think this is going to solve our problem on its own. If CS put the new cert in the path defined by nginx_ssl_cert_file, while the one in the cache is the old cert, the checksums will be different and the new cert will get overwritten (i.e. it still requires someone to copy the newly placed certs into the cache location).

@ruaridhg
Copy link
Contributor Author

Unfortunately I don't think this is going to solve our problem on its own. If CS put the new cert in the path defined by nginx_ssl_cert_file, while the one in the cache is the old cert, the checksums will be different and the new cert will get overwritten (i.e. it still requires someone to copy the newly placed certs into the cache location).

Ah, yep that makes sense. Okay, I'll work on this more on Monday.

p-j-smith
p-j-smith requested changes Nov 30, 2024
View reviewed changes
Copy link
Contributor

@p-j-smith p-j-smith left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to add to @drmatthews point, the x509_certificate_info_module will probably be useful here - you could check and compare the expiry dates (not after) of the certs. It might also be worth setting backup: true when copying the cert and key from cache

p-j-smith
p-j-smith requested changes Dec 2, 2024
View reviewed changes
Copy link
Contributor

@p-j-smith p-j-smith left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking good! There are quite a few tasks that run when: nginx_use_ssl - perhaps we could put them into a separate file and include the file when SSL is enabled?

p-j-smith
p-j-smith reviewed Dec 4, 2024
View reviewed changes
Copy link
Contributor

@p-j-smith p-j-smith left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ruaridhg I've pushed some changes to:

  • check certificate expiry date in the nginx role before copying to/from cache
  • added variable to ssl_certificates role to set the expiry date (all usages of the role set to the default of 10 years, except for the nginx tests where two certs are generated)
  • update tomcat version

playbooks/group_vars/db.yml
@@ -37,6 +37,7 @@ postgresql_ssl_certificate:
csr_common_name: "{{ db_server.host }}"
certificate_filename: "{{ postgresql.base_directory }}/certs/server.crt"
provider: selfsigned
selfsigned_not_after: +3650d
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the default value

roles/tomcat/defaults/main.yml
@@ -7,7 +7,7 @@ java_home: /usr/lib/jvm/jre
java_profile_d: /etc/profile.d

# mirsg.tomcat
tomcat_version: 9.0.82
tomcat_version: 9.0.97
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated tomcat as 9.0.82 seems to no longer be available for download

p-j-smith
p-j-smith previously approved these changes Dec 4, 2024
View reviewed changes
drmatthews
drmatthews reviewed Dec 4, 2024
View reviewed changes
Copy link
Contributor

@drmatthews drmatthews left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great!

Very minor (and ignorable) but I removed some unnecessary double quotes from the example in the README.md file of the nginx.

drmatthews
drmatthews approved these changes Dec 4, 2024
View reviewed changes
Copy link
Contributor

@drmatthews drmatthews left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

@ruaridhg
Copy link
Contributor Author

ruaridhg commented Dec 4, 2024

@ruaridhg I've pushed some changes to:

  • check certificate expiry date in the nginx role before copying to/from cache
  • added variable to ssl_certificates role to set the expiry date (all usages of the role set to the default of 10 years, except for the nginx tests where two certs are generated)
  • update tomcat version

Thanks, this looks like it covers everything we discussed!

@ruaridhg ruaridhg merged commit f37d01f into main Dec 4, 2024
22 checks passed
@ruaridhg ruaridhg deleted the 145-ssl-certs-in-nginx branch December 4, 2024 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@drmatthews drmatthews drmatthews approved these changes

@p-j-smith p-j-smith p-j-smith left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

SSL certificates get overwritten in nginx role
3 participants
@ruaridhg @drmatthews @p-j-smith