10:28 a.m.
fedorapeople.org's wildcard SSL cert expired. I generated a Let's Encrypt
wildcard cert using a DNS challenge and copied that to fedorapeople and
edited the /etc/httpd/conf.d/people.conf file to point to the LE cert. I
did this as an emergency fix to get the web server accessible again. I did
not change anything in Ansible for this emergency fix.
Hopefully no one will run the people playbook before the regular cert gets
renewed, or my changes will be overwritten.
I think I need to ask for 2 (after the fact) +1's.
nb
10:31 a.m.
On Fri, 7 Oct 2022 at 11:28, Nick Bebout <nick(a)bebout.net> wrote:
fedorapeople.org's wildcard SSL cert expired. I generated a
Let's
Encrypt wildcard cert using a DNS challenge and copied that to fedorapeople
and edited the /etc/httpd/conf.d/people.conf file to point to the LE cert.
I did this as an emergency fix to get the web server accessible again. I
did not change anything in Ansible for this emergency fix.
Hopefully no one will run the people playbook before the regular cert gets
renewed, or my changes will be overwritten.
OK. Thanks for doing this. What would it take to make this permanent on the
server?
+1
I think I need to ask for 2 (after the fact) +1's.
nb
_______________________________________________
infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
To unsubscribe send an email to
infrastructure-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren
1:38 p.m.
I don't think we can (easily) make it keep renewing the Let's Encrypt cert,
as LE requires DNS validation for wildcard certs. I did the validation
manually. I could probably patch Ansible to not overwrite my config
changes, if we want to go that route.
On Fri, Oct 7, 2022 at 10:39 AM Stephen Smoogen <ssmoogen(a)redhat.com> wrote:
On Fri, 7 Oct 2022 at 11:28, Nick Bebout <nick(a)bebout.net> wrote:
> fedorapeople.org's wildcard SSL cert expired. I generated a Let's
> Encrypt wildcard cert using a DNS challenge and copied that to fedorapeople
> and edited the /etc/httpd/conf.d/people.conf file to point to the LE cert.
> I did this as an emergency fix to get the web server accessible again. I
> did not change anything in Ansible for this emergency fix.
>
> Hopefully no one will run the people playbook before the regular cert
> gets renewed, or my changes will be overwritten.
>
>
OK. Thanks for doing this. What would it take to make this permanent on
the server?
+1
> I think I need to ask for 2 (after the fact) +1's.
>
> nb
> _______________________________________________
> infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
> To unsubscribe send an email to
> infrastructure-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
--
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren
_______________________________________________
infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
To unsubscribe send an email to
infrastructure-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
1:48 p.m.
I just did this to stop Ansible from overwriting my changes. Revert my
commit whenever the certificate is renewed/replaced.
diff --git a/roles/people/tasks/main.yml b/roles/people/tasks/main.yml
index d6f296fe54..0b620115f8 100644
--- a/roles/people/tasks/main.yml
+++ b/roles/people/tasks/main.yml
@@ -21,11 +21,11 @@
- packages
- people
-- name: install main httpd config
- template: src=people.conf dest=/etc/httpd/conf.d/people.conf
- tags:
- - people
- - sslciphers
+#- name: install main httpd config
+# template: src=people.conf dest=/etc/httpd/conf.d/people.conf
+# tags:
+# - people
+# - sslciphers
- name: install httpd config
copy: src={{item}} dest=/etc/httpd/conf.d/{{item}}
On Fri, Oct 7, 2022 at 1:38 PM Nick Bebout <nick(a)bebout.net> wrote:
I don't think we can (easily) make it keep renewing the Let's
Encrypt
cert, as LE requires DNS validation for wildcard certs. I did the
validation manually. I could probably patch Ansible to not overwrite my
config changes, if we want to go that route.
On Fri, Oct 7, 2022 at 10:39 AM Stephen Smoogen <ssmoogen(a)redhat.com>
wrote:
>
>
> On Fri, 7 Oct 2022 at 11:28, Nick Bebout <nick(a)bebout.net> wrote:
>
>> fedorapeople.org's wildcard SSL cert expired. I generated a Let's
>> Encrypt wildcard cert using a DNS challenge and copied that to fedorapeople
>> and edited the /etc/httpd/conf.d/people.conf file to point to the LE cert.
>> I did this as an emergency fix to get the web server accessible again. I
>> did not change anything in Ansible for this emergency fix.
>>
>> Hopefully no one will run the people playbook before the regular cert
>> gets renewed, or my changes will be overwritten.
>>
>>
> OK. Thanks for doing this. What would it take to make this permanent on
> the server?
> +1
>
>
>
>> I think I need to ask for 2 (after the fact) +1's.
>>
>> nb
>> _______________________________________________
>> infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
>> To unsubscribe send an email to
>> infrastructure-leave(a)lists.fedoraproject.org
>> Fedora Code of Conduct:
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>>
https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
>> Do not reply to spam, report it:
>> https://pagure.io/fedora-infrastructure/new_issue
>>
>
>
> --
> Stephen Smoogen, Red Hat Automotive
> Let us be kind to one another, for most of us are fighting a hard battle.
> -- Ian MacClaren
> _______________________________________________
> infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
> To unsubscribe send an email to
> infrastructure-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
2 p.m.
On Fri, 7 Oct 2022 at 14:39, Nick Bebout <nick(a)bebout.net> wrote:
I don't think we can (easily) make it keep renewing the Let's
Encrypt
cert, as LE requires DNS validation for wildcard certs. I did the
validation manually. I could probably patch Ansible to not overwrite my
config changes, if we want to go that route.
What is needed for DNS validation? A constantly updated DNS record or
something else?
--
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren
2:25 p.m.
DNS validation needs someone (or a DNS plugin for Certbot) to add a DNS
record each time the certificate renews (by default Certbot renews 30 days
before expiration. This works very well if your DNS provider is supported
by one of certbot's plugins, but not as well if you have to update it
manually. I'm not sure if there is a way to integrate it into our current
DNS setup.
On Fri, Oct 7, 2022 at 2:09 PM Stephen Smoogen <ssmoogen(a)redhat.com> wrote:
On Fri, 7 Oct 2022 at 14:39, Nick Bebout <nick(a)bebout.net> wrote:
> I don't think we can (easily) make it keep renewing the Let's Encrypt
> cert, as LE requires DNS validation for wildcard certs. I did the
> validation manually. I could probably patch Ansible to not overwrite my
> config changes, if we want to go that route.
>
>
What is needed for DNS validation? A constantly updated DNS record or
something else?
--
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle.
-- Ian MacClaren
_______________________________________________
infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
To unsubscribe send an email to
infrastructure-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
8:50 a.m.
New subject: [EMERGENCY FREEZE BREAK] Temporarily fix fedorapeople.org SSL
cert
On 07/10/2022 21:25, Nick Bebout wrote:
DNS validation needs someone (or a DNS plugin for Certbot) to add a
DNS
record each time the certificate renews (by default Certbot renews 30
days before expiration. This works very well if your DNS provider is
supported by one of certbot's plugins, but not as well if you have to
update it manually. I'm not sure if there is a way to integrate it into
our current DNS setup.
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
For centos.org (and sub-domains) we're also using DNS validation with
ACME and it's all automatic : bind supports dynamic zones (and we have a
delegated acme.centos.org zone for that reason) : I already mentioned it
to Kevin and Mark and pointed to the presentation : so one doesn't have
to edit DNS : just let the tool do it for you :)
--
Fabian Arrotin
gpg key: 17F3B7A1 | twitter: @arrfab
11:22 a.m.
New subject: [EMERGENCY FREEZE BREAK] Temporarily fix fedorapeople.org SSL
cert
On Sat, Oct 08, 2022 at 03:50:35PM +0200, Fabian Arrotin wrote:
On 07/10/2022 21:25, Nick Bebout wrote:
> DNS validation needs someone (or a DNS plugin for Certbot) to add a DNS
> record each time the certificate renews (by default Certbot renews 30
> days before expiration. This works very well if your DNS provider is
> supported by one of certbot's plugins, but not as well if you have to
> update it manually. I'm not sure if there is a way to integrate it into
> our current DNS setup.
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
For centos.org (and sub-domains) we're also using DNS validation with ACME
and it's all automatic : bind supports dynamic zones (and we have a
delegated acme.centos.org zone for that reason) : I already mentioned it to
Kevin and Mark and pointed to the presentation : so one doesn't have to edit
DNS : just let the tool do it for you :)
Yeah. We just haven't set this up yet. Might be a nice thing to do after
f37 is out the door. We do have automated http challenges, so we can
(and do) get non wildcard certs that way in a automated way, just not
the wildcard ones (they need dns).
Thanks for dealing with this Nick!
kevin
1:26 p.m.
New subject: [EMERGENCY FREEZE BREAK] Temporarily fix fedorapeople.org SSL
cert
On 10/12/22 19:22, Kevin Fenzi wrote:
On Sat, Oct 08, 2022 at 03:50:35PM +0200, Fabian Arrotin wrote:
> On 07/10/2022 21:25, Nick Bebout wrote:
>> DNS validation needs someone (or a DNS plugin for Certbot) to add a DNS
>> record each time the certificate renews (by default Certbot renews 30
>> days before expiration. This works very well if your DNS provider is
>> supported by one of certbot's plugins, but not as well if you have to
>> update it manually. I'm not sure if there is a way to integrate it into
>> our current DNS setup.
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
> For centos.org (and sub-domains) we're also using DNS validation with ACME
> and it's all automatic : bind supports dynamic zones (and we have a
> delegated acme.centos.org zone for that reason) : I already mentioned it to
> Kevin and Mark and pointed to the presentation : so one doesn't have to edit
> DNS : just let the tool do it for you :)
Yeah. We just haven't set this up yet. Might be a nice thing to do after
f37 is out the door. We do have automated http challenges, so we can
(and do) get non wildcard certs that way in a automated way, just not
the wildcard ones (they need dns).
As certbot has become quite heavy, maybe one of
[1],[2] or [3] can help?
1)
https://packages.fedoraproject.org/pkgs/uacme/uacme/https://packages.fedo...
2) https://packages.fedoraproject.org/pkgs/dehydrated/dehydrated/
3) https://pypi.org/project/sewer/https://pypi.org/project/sewer/
Thanks for dealing with this Nick!
kevin
7:28 p.m.
I am quite happy with certbot, I think really the issue is we just need to
take the time to set up the DNS validation. But thanks for the suggestions.
On Wed, Oct 12, 2022 at 13:34 Benson Muite <benson_muite(a)emailplus.org>
wrote:
On 10/12/22 19:22, Kevin Fenzi wrote:
> On Sat, Oct 08, 2022 at 03:50:35PM +0200, Fabian Arrotin wrote:
>> On 07/10/2022 21:25, Nick Bebout wrote:
>>> DNS validation needs someone (or a DNS plugin for Certbot) to add a DNS
>>> record each time the certificate renews (by default Certbot renews 30
>>> days before expiration. This works very well if your DNS provider is
>>> supported by one of certbot's plugins, but not as well if you have to
>>> update it manually. I'm not sure if there is a way to integrate it
into
>>> our current DNS setup.
>> Do not reply to spam, report it:
>> https://pagure.io/fedora-infrastructure/new_issue
>>
>> For centos.org (and sub-domains) we're also using DNS validation with
ACME
>> and it's all automatic : bind supports dynamic zones (and we have a
>> delegated acme.centos.org zone for that reason) : I already mentioned
it to
>> Kevin and Mark and pointed to the presentation : so one doesn't have to
edit
>> DNS : just let the tool do it for you :)
>
> Yeah. We just haven't set this up yet. Might be a nice thing to do after
> f37 is out the door. We do have automated http challenges, so we can
> (and do) get non wildcard certs that way in a automated way, just not
> the wildcard ones (they need dns).
As certbot has become quite heavy, maybe one of [1],[2] or [3] can help?
1)
https://packages.fedoraproject.org/pkgs/uacme/uacme/https://packages.fedo...
2) https://packages.fedoraproject.org/pkgs/dehydrated/dehydrated/
3) https://pypi.org/project/sewer/https://pypi.org/project/sewer/
>
> Thanks for dealing with this Nick!
>
> kevin
>
>
_______________________________________________
infrastructure mailing list -- infrastructure(a)lists.fedoraproject.org
To unsubscribe send an email to
infrastructure-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/infrastructure@lists.fedora...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
3:28 a.m.
New subject: [EMERGENCY FREEZE BREAK] Temporarily fix fedorapeople.org SSL
cert
Thanks for the work, here is a +1 from me as well.
Michal
On 07. 10. 22 17:28, Nick Bebout wrote:
fedorapeople.org <http://fedorapeople.org>'s wildcard SSL
cert
expired. I generated a Let's Encrypt wildcard cert using a DNS
challenge and copied that to fedorapeople and edited the
/etc/httpd/conf.d/people.conf file to point to the LE cert. I did
this as an emergency fix to get the web server accessible again. I
did not change anything in Ansible for this emergency fix.
Hopefully no one will run the people playbook before the regular cert
gets renewed, or my changes will be overwritten.
I think I need to ask for 2 (after the fact) +1's.
nb
_______________________________________________
infrastructure mailing list --infrastructure(a)lists.fedoraproject.org
To unsubscribe send an email toinfrastructure-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
List
Archives:https://lists.fedoraproject.org/archives/list/infrastructure@lis...
Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue
561
days inactive
568
days old
infrastructure@lists.fedoraproject.org
10 comments
6 participants
participants (6)
-
Benson Muite -
Fabian Arrotin -
Kevin Fenzi -
Michal Konecny -
Nick Bebout -
Stephen Smoogen