Hot answers tagged

19

Better method, thanks to the others responses for helping me get to this. Determine what plugins are installed currently: # certbot-auto plugins Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * apache Description: Apache Web Server plugin - Beta Interfaces: ...


15

First run # type certbot certbot is hashed (/usr/bin/certbot) To find out where certbot is installed to. Or command -v certbot if you prefer. Then run head /usr/bin/certbot and note what version of Python it's using: #!/usr/bin/python3 In my case, it was using Python 3. I noticed from my pip output it was trying to install a Python 2.7 package: # pip ...


15

There's a couple of way to achieve the result: Chef has a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation Chef use its own CA certiticate list in /opt/...


8

Now (July 2018), you should be able to use either pip install certbot-dns-digitalocean or git clone https://github.com/certbot/certbot.git cd certbot/certbot-dns-digitalocean/ python setup.py install You may need sudo privileges for either. After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot ...


7

To do this, you’ll first need your kubeadm configuration file. This creates a file named kubeadm.yaml: kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' > kubeadm.yaml Now open the file in an editor, and find the certSANs list under the apiServer section. If it does not exist, you’ll need to add it; if so, ...


5

While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself: yum -y install gcc python-devel libffi-devel openssl-devel pip install pyopenssl ndg-httpsclient pyasn1 (This works for requests at least, I'm not sure about Ansible.) On a broader note: ...


3

You have to use Docker to use dns plugins. From DNS Plugins: These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.


3

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.


2

The same rules apply to hardening Jenkins as for all other web applications: Put sensitive content behind an authentication/authorization barrier Use SSL for transport-layer encryption and verifying the identity of the server Restrict network-level access to only networks where clients should be connection from Regarding client authn/authz - that's pretty ...


2

Besides the transport layer you should first of all enable Access Control to protect jenkins from public access.


2

Been hit by this just today after a fresh install so here's how I got over it: From your logs (emphasis is mine): fatal: unable to access ... : schannel: next InitializeSecurityContext failed: git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle. To switch to openssl to use ...


2

Have a look at "Ingress" and "Cert-Manager": With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer With "Cert-Manager" you can get certificates from Let's Encrypt (like certbot does), and it handles renewing automatically. See https://github.com/jetstack/cert-manager


2

First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script. I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec ...


2

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository. Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a ...


2

This error occurrs because you do not add the root CA in your chain.pem file: for solutions add below chain in your chain.pem file: -----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow ...


2

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network). A wider answer would primarily depend on whether you trust your Docker host and services on ...


1

Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode. See example at https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server Shown here for convenience: server { listen 80; listen 443 ssl; server_name www.example....


1

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this. these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works. msdn how to configure ciphersuite for app service enforce tls vrsion The client (browser) gives a list of cipher suites it can ...


1

Since we are using ISTIO as Ingress Gateway with Kubernetes, the issue is related to ISTIO gateway config. We simply had to replace the matching host to '*' in ISTIO gateway config


1

I realize it's because the link for tomcat I was deploying to was: https://localhost:portNo, instead of simply, http://localhost:portNo


1

It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works: wget our.cert.server.com/CA.crt cat CA.crt >> /etc/ssl/cert.pem sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories apk update


1

The answer given by @Eduardo Baitello is the correct answer for the vast majority of Kube installs. However I learned that if you've installed the MicroK8S snap install on Ubuntu the instructions are a little bit different. Per this issue, you'll need to update the /var/snap/microk8s/current/certs/csr.conf.template file, then run microk8s.stop and microk8s....


1

Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not. One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer ...


1

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster) python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb


1

Changed the challenge from tls-sni to: --preferred-challenges http and the certificates are renewed.


1

For those who is using certbot distributed by OS distros certbot plugins can be installed by a package manager using provider's name, for example: Debian/Ubuntu: apt-get install python3-certbot-dns-cloudflare apt-get install python3-certbot-dns-google apt-get install python3-certbot-dns-route53 RHEL/CentOS/Rocky/AlmaLinux 8: dnf install python3-certbot-dns-...


1

This worked for me on Ubuntu 18.04 LTS apt install certbot apt install python3-certbot-dns-digitalocean See this certbot issue


1

One could use the apt module of Ansible. http://docs.ansible.com/ansible/latest/apt_module.html The apt module uses apt and apt itself is able to check whether a package has already been installed and will prevent that it will be installed as it has already been installed. I use this module myself as well. As the idempotence test passes it indicates that ...


1

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers. A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...


1

I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting. One could use Geerlingguys git role to install the latest git on CentOS7. It is possible to install this by issuing ansible-galaxy install geerlingguy.git and subsequently include geerlingguy.git in the roles in order to apply the ...


Only top voted, non community-wiki answers of a minimum length are eligible