Hot answers tagged

21 votes

How to install Certbot plugins?

Better method, thanks to the others responses for helping me get to this. Determine what plugins are installed currently: # certbot-auto plugins Saving debug log to /var/log/letsencrypt/letsencrypt....
user avatar
  • 311
15 votes
Accepted

How do I include my internal CA certificate to validate SSL exchanges in Chef?

There's a couple of way to achieve the result: Chef has a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to ...
user avatar
  • 11.1k
15 votes
Accepted

How to install Certbot plugins?

First run # type certbot certbot is hashed (/usr/bin/certbot) To find out where certbot is installed to. Or command -v certbot if you prefer. Then run head /usr/bin/certbot and note what version of ...
user avatar
  • 581
13 votes
Accepted

How can I add an additional IP / hostname to my Kubernetes certificate?

To do this, you’ll first need your kubeadm configuration file. This creates a file named kubeadm.yaml: kubectl -n kube-system get configmap kubeadm-config -o jsonpath='{.data.ClusterConfiguration}' &...
user avatar
8 votes

How to install Certbot plugins?

Now (July 2018), you should be able to use either pip install certbot-dns-digitalocean or git clone https://github.com/certbot/certbot.git cd certbot/certbot-dns-digitalocean/ python setup.py ...
user avatar
  • 181
5 votes

Validating certificates with get_url or yum on CentOS 7 using Ansible

While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself: yum -y install gcc python-devel ...
user avatar
3 votes

How to install Certbot plugins?

You have to use Docker to use dns plugins. From DNS Plugins: These plugins are still in the process of being packaged by many distributions and cannot currently be installed with certbot-auto. If, ...
user avatar
3 votes
Accepted

terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something ...
user avatar
  • 1,197
2 votes
Accepted

What are best practices for implementing SSL on Jenkins?

The same rules apply to hardening Jenkins as for all other web applications: Put sensitive content behind an authentication/authorization barrier Use SSL for transport-layer encryption and verifying ...
user avatar
  • 2,753
2 votes

What are best practices for implementing SSL on Jenkins?

Besides the transport layer you should first of all enable Access Control to protect jenkins from public access.
user avatar
  • 181
2 votes

Git seems to recognize http.sslcainfo property from .gitconfig but ignores it on execution? SEC_E_UNTRUSTED_ROOT

Been hit by this just today after a fresh install so here's how I got over it: From your logs (emphasis is mine): fatal: unable to access ... : schannel: next InitializeSecurityContext failed: ...
user avatar
  • 11.1k
2 votes
Accepted

What are trusted providers that offer wildcard certificates and associated costs to be used in an Orchestration Platform like Kubernetes?

Have a look at "Ingress" and "Cert-Manager": With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer With "Cert-...
user avatar
  • 171
2 votes

How to install Certbot plugins?

The way you install certbot plugins depends on how you installed certbot itself. If you installed certbot using some package manager (apt, rpm, brew...), then you should look for compatible certbot ...
user avatar
  • 121
2 votes

How to install Certbot plugins?

For those who is using certbot distributed by OS distros certbot plugins can be installed by a package manager using provider's name, for example: Debian/Ubuntu: apt-get install python3-certbot-dns-...
user avatar
  • 121
2 votes

Kubernets docker registry behind nginx-ingress

First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in ...
user avatar
2 votes
Accepted

Unable to validate certificate chain: cert.pem in Zimbra mail server

This error occurrs because you do not add the root CA in your chain.pem file: for solutions add below chain in your chain.pem file: -----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+...
user avatar
  • 1,361
2 votes

Is SSL/HTTPS Needed Between Docker Containers on the Same Network?

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access ...
user avatar
  • 66
2 votes

Ingress vs Load Balancer

After talking with the support staff from the cloud provider, reading through the docs and looking at how other cloud providers do it, I believe that both of them are needed. In order to have a simple ...
user avatar
1 vote

How to check accepted cipher suites by an Azure App Service?

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this. these are the resources that I found when I am looking up for tls enabling for my app service. ...
user avatar
1 vote
Accepted

TLS handshake failure

Since we are using ISTIO as Ingress Gateway with Kubernetes, the issue is related to ISTIO gateway config. We simply had to replace the matching host to '*' in ISTIO gateway config
user avatar
  • 121
1 vote
Accepted

Jenkins Deployment Issue - Unrecognized SSL Message, Plaintext Connection?

I realize it's because the link for tomcat I was deploying to was: https://localhost:portNo, instead of simply, http://localhost:portNo
user avatar
1 vote

How do I bootstrap an alpine image to work with a private repo proxy behind TLS?

It turns out that /etc/ssl/cert.pem is the bundle scanned by apk to verify a repo behind HTTPS, so the following works: wget our.cert.server.com/CA.crt cat CA.crt >> /etc/ssl/cert.pem sed -i 's,...
user avatar
  • 265
1 vote

How can I add an additional IP / hostname to my Kubernetes certificate?

The answer given by @Eduardo Baitello is the correct answer for the vast majority of Kube installs. However I learned that if you've installed the MicroK8S snap install on Ubuntu the instructions are ...
user avatar
  • 153
1 vote

Issue with custom domain SSL certification

Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not. One of the core security pillars of a secure certificate is that it ensures that you are ...
user avatar
  • 650
1 vote

certbot renewal fails over ipv6

Changed the challenge from tls-sni to: --preferred-challenges http and the certificates are renewed.
user avatar
  • 183
1 vote

How to install Certbot plugins?

I had the same problem, after I updated certbot on OS X I could not get the digitalocean plugin to appear, even after re-installing it with pip install certbot-dns-digitalocean. The solution was to ...
user avatar
1 vote

How to install Certbot plugins?

This worked for me on Ubuntu 18.04 LTS apt install certbot apt install python3-certbot-dns-digitalocean See this certbot issue
user avatar
  • 11
1 vote

How to install Certbot plugins?

If you're on ubuntu or debian, you can grab the following packages from debian testing (buster) python3-certbot-dns-digitalocean_0.23.0-2_all.deb python3-digitalocean_1.13.2-1_all.deb
user avatar
1 vote

Conditionally run certbot

One could use the apt module of Ansible. http://docs.ansible.com/ansible/latest/apt_module.html The apt module uses apt and apt itself is able to check whether a package has already been installed ...
user avatar
  • 12.6k
1 vote

Is it possible to load balance TLS/SSL based logstash communication to elasticsearch?

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to ...
user avatar
  • 3,674

Only top scored, non community-wiki answers of a minimum length are eligible