Hot answers tagged

13

There's a couple of way to achieve the result: Chef have a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation Chef use its own CA certiticate list in /...


12

Better method, thanks to the others responses for helping me get to this. Determine what plugins are installed currently: # certbot-auto plugins Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - * apache Description: Apache Web Server plugin - Beta Interfaces: ...


8

Now (July 2018), you should be able to use either pip install certbot-dns-digitalocean or git clone https://github.com/certbot/certbot.git cd certbot/certbot-dns-digitalocean/ python setup.py install You may need sudo privileges for either. After installing you may not be able to see the plugin with certbot plugins, but you should be able to certbot ...


7

First run # type certbot certbot is hashed (/usr/bin/certbot) To find out where certbot is installed to. Or command -v certbot if you prefer. Then run head /usr/bin/certbot and note what version of Python it's using: #!/usr/bin/python3 In my case, it was using Python 3. I noticed from my pip output it was trying to install a Python 2.7 package: # pip ...


3

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.


3

While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself: yum -y install gcc python-devel libffi-devel openssl-devel pip install pyopenssl ndg-httpsclient pyasn1 (This works for requests at least, I'm not sure about Ansible.) On a broader note: ...


3

You have to use Docker to use dns plugins. From DNS Plugins: These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, however, you are comfortable installing the certificates yourself, you can run these plugins with Docker.


2

The same rules apply to hardening Jenkins as for all other web applications: Put sensitive content behind an authentication/authorization barrier Use SSL for transport-layer encryption and verifying the identity of the server Restrict network-level access to only networks where clients should be connection from Regarding client authn/authz - that's pretty ...


2

Besides the transport layer you should first of all enable Access Control to protect jenkins from public access.


2

Been hit by this just today after a fresh install so here's how I got over it: From your logs (emphasis is mine): fatal: unable to access ... : schannel: next InitializeSecurityContext failed: git is configured to use schannel (windows native implementation), but schannel use windows certs bundle and not a the cainfo bundle. To switch to openssl to use ...


2

Have a look at "Ingress" and "Cert-Manager": With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer With "Cert-Manager" you can get certificates from Let's Encrypt (like certbot does), and it handles renewing automatically. See https://github.com/jetstack/cert-manager


2

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot plugins in that package manager's repository. Let's Encrypt also support an alternative installation method: the certbot-auto wrapper. This wrapper creates a ...


1

This error occurrs because you do not add the root CA in your chain.pem file: for solutions add below chain in your chain.pem file: -----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow ...


1

Changed the challenge from tls-sni to: --preferred-challenges http and the certificates are renewed.


1

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster) python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb


1

I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting. One could use Geerlingguys git role to install the latest git on CentOS7. It is possible to install this by issuing ansible-galaxy install geerlingguy.git and subsequently include geerlingguy.git in the roles in order to apply the ...


1

One could use the apt module of Ansible. http://docs.ansible.com/ansible/latest/apt_module.html The apt module uses apt and apt itself is able to check whether a package has already been installed and will prevent that it will be installed as it has already been installed. I use this module myself as well. As the idempotence test passes it indicates that ...


1

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers. A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...


1

I had something similar a year ago, so I hope I remember - You should have all the certificate chain in the crt file. Verify that you have all the intermediate certificates between your bitbucket certificate and the root one (inclusive). You can have a look at the correct format for appending them in the pem format (which I believe is your case with the ...


Only top voted, non community-wiki answers of a minimum length are eligible