particle-os/debian-koji-osbuild
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: generate koji certs with SAN in make-certs.sh

Browse source 
Generate the certificate to be used for koji in make-certs.sh by
the same CA that also generates the composer and client certs.
Create a single certificate that uses the SubjectAltName (SAN)
extension to cover two domains: localhost, org.osbuild.koji.koji,
which previously was done via two separate certificates; this is
the legacy usage which stopped working with go 1.15 (see previous
commit). As a consequence the apache config is modified to use
only one virtual host with a ServerAlias directive.
This commit is contained in:
Christian Kellner 2020-11-11 16:52:02 +01:00
parent 6f439dc34f
commit 630d09f6c4
6 changed files with 43 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

43
test/container/hub/ssl.conf
View file

@ -13,6 +13,7 @@ SSLCryptoDevice builtin
# localhost
<VirtualHost _default_:443>
ServerName localhost
ServerAlias org.osbuild.koji.koji
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
@ -23,44 +24,10 @@ SSLEngine on
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /share/crt.pem
SSLCertificateKeyFile /share/key.pem
SSLCertificateChainFile /share/ca-crt.pem
SSLCACertificateFile /share/ca-crt.pem
SSLVerifyDepth 1
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
# Full Qualified Domain Name, org.osbuild.koji.koji
<VirtualHost _default_:443>
ServerName org.osbuild.koji.koji
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel debug
SSLEngine on
SSLHonorCipherOrder on
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
SSLCertificateFile /share/crt-fqdn.pem
SSLCertificateKeyFile /share/key.pem
SSLCertificateChainFile /share/ca-crt.pem
SSLCACertificateFile /share/ca-crt.pem
SSLCertificateFile /share/koji-crt.pem
SSLCertificateKeyFile /share/koji-key.pem
SSLCertificateChainFile /share/koji-ca.pem
SSLCACertificateFile /share/koji-ca.pem
SSLVerifyDepth 1
<FilesMatch "\.(cgi|shtml|phtml|php)$">