There's a couple of way to achieve the result:
Chef have a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation
Chef use its own CA certiticate list in /...
Now (July 2018), you should be able to use either
pip install certbot-dns-digitalocean
git clone https://github.com/certbot/certbot.git
python setup.py install
You may need sudo privileges for either.
After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot ...
# type certbot
certbot is hashed (/usr/bin/certbot)
To find out where certbot is installed to. Or command -v certbot if you prefer.
Then run head /usr/bin/certbot and note what version of Python it's using:
In my case, it was using Python 3.
I noticed from my pip output it was trying to install a Python 2.7 package:
# pip ...
Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.
While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself:
yum -y install gcc python-devel libffi-devel openssl-devel
pip install pyopenssl ndg-httpsclient pyasn1
(This works for requests at least, I'm not sure about Ansible.)
On a broader note:
You have to use Docker to use dns plugins. From DNS Plugins:
These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.
The same rules apply to hardening Jenkins as for all other web applications:
Put sensitive content behind an authentication/authorization barrier
Use SSL for transport-layer encryption and verifying the identity of the server
Restrict network-level access to only networks where clients should be connection from
Regarding client authn/authz - that's pretty ...
Been hit by this just today after a fresh install so here's how I got over it:
From your logs (emphasis is mine):
fatal: unable to access ... : schannel: next InitializeSecurityContext failed:
git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle.
To switch to openssl to use ...
Have a look at "Ingress" and "Cert-Manager":
With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer
With "Cert-Manager" you can get certificates from Let's Encrypt (like certbot does), and it handles renewing automatically. See https://github.com/jetstack/cert-manager
The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository.
Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a ...
This error occurrs because you do not add the root CA in your chain.pem file:
for solutions add below chain in your chain.pem file:
I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting.
One could use Geerlingguys git role to install the latest git on CentOS7. It is possible to install this by issuing ansible-galaxy install geerlingguy.git and subsequently include geerlingguy.git in the roles in order to apply the ...
One could use the apt module of Ansible. http://docs.ansible.com/ansible/latest/apt_module.html
The apt module uses apt and apt itself is able to check whether a package has already been installed and will prevent that it will be installed as it has already been installed.
I use this module myself as well. As the idempotence test passes it indicates that ...
You can do this a couple of ways, but I have never seen anyone do this with a CNAME.
One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers.
A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...
I had something similar a year ago, so I hope I remember -
You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive).
You can have a look at the correct format for appending them in the pem format (which I believe is your case with the ...