Hot answers tagged

19

Better method, thanks to the others responses for helping me get to this. Determine what plugins are installed currently: # certbot-auto plugins Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * apache Description: Apache Web Server plugin - Beta Interfaces: ...


14

There's a couple of way to achieve the result: Chef has a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation Chef use its own CA certiticate list in /opt/...


13

First run # type certbot certbot is hashed (/usr/bin/certbot) To find out where certbot is installed to. Or command -v certbot if you prefer. Then run head /usr/bin/certbot and note what version of Python it's using: #!/usr/bin/python3 In my case, it was using Python 3. I noticed from my pip output it was trying to install a Python 2.7 package: # pip ...


8

Now (July 2018), you should be able to use either pip install certbot-dns-digitalocean or git clone https://github.com/certbot/certbot.git cd certbot/certbot-dns-digitalocean/ python setup.py install You may need sudo privileges for either. After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot ...


5

To do this, you’ll first need your kubeadm configuration file. This creates a file named kubeadm.yaml: kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' > kubeadm.yaml Now open the file in an editor, and find the certSANs list under the apiServer section. If it does not exist, you’ll need to add it; if so, ...


4

While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself: yum -y install gcc python-devel libffi-devel openssl-devel pip install pyopenssl ndg-httpsclient pyasn1 (This works for requests at least, I'm not sure about Ansible.) On a broader note: ...


3

You have to use Docker to use dns plugins. From DNS Plugins: These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.


3

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.


2

The same rules apply to hardening Jenkins as for all other web applications: Put sensitive content behind an authentication/authorization barrier Use SSL for transport-layer encryption and verifying the identity of the server Restrict network-level access to only networks where clients should be connection from Regarding client authn/authz - that's pretty ...


2

Besides the transport layer you should first of all enable Access Control to protect jenkins from public access.


2

Been hit by this just today after a fresh install so here's how I got over it: From your logs (emphasis is mine): fatal: unable to access ... : schannel: next InitializeSecurityContext failed: git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle. To switch to openssl to use ...


2

Have a look at "Ingress" and "Cert-Manager": With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer With "Cert-Manager" you can get certificates from Let's Encrypt (like certbot does), and it handles renewing automatically. See https://github.com/jetstack/cert-manager


2

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository. Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a ...


2

First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script. I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec ...


1

Since we are using ISTIO as Ingress Gateway with Kubernetes, the issue is related to ISTIO gateway config. We simply had to replace the matching host to '*' in ISTIO gateway config


1

I realize it's because the link for tomcat I was deploying to was: https://localhost:portNo, instead of simply, http://localhost:portNo


1

It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works: wget our.cert.server.com/CA.crt cat CA.crt >> /etc/ssl/cert.pem sed -i 's,http://dl-cdn.alpinelinux.org/alpine,https://nexus-endpoint.company.com/repository/alpine-proxy,' /etc/apk/repositories apk update


1

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this. these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works. msdn how to configure ciphersuite for app service enforce tls vrsion The client (browser) gives a list of cipher suites it can ...


1

This error occurrs because you do not add the root CA in your chain.pem file: for solutions add below chain in your chain.pem file: -----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow ...


1

Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not. One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer ...


1

Changed the challenge from tls-sni to: --preferred-challenges http and the certificates are renewed.


1

This worked for me on Ubuntu 18.04 LTS apt install certbot apt install python3-certbot-dns-digitalocean See this certbot issue


1

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster) python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb


1

One could use the apt module of Ansible. http://docs.ansible.com/ansible/latest/apt_module.html The apt module uses apt and apt itself is able to check whether a package has already been installed and will prevent that it will be installed as it has already been installed. I use this module myself as well. As the idempotence test passes it indicates that ...


1

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers. A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...


1

I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting. One could use Geerlingguys git role to install the latest git on CentOS7. It is possible to install this by issuing ansible-galaxy install geerlingguy.git and subsequently include geerlingguy.git in the roles in order to apply the ...


1

I had something similar a year ago, so I hope I remember - You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive). You can have a look at the correct format for appending them in the pem format (which I believe is your case with the ...


Only top voted, non community-wiki answers of a minimum length are eligible