Alex Monk has uploaded a new change for review.
https://gerrit.wikimedia.org/r/247587
Change subject: Change star.wmflabs.org to beta certificate
......................................................................
Change star.wmflabs.org to beta certificate
We could make this cert use SAN, so it actually matches the domains, but
browsers still wouldn't trust it.
Bug: T70387
Change-Id: I450316d795046ed49d057b221433ce9b172b9d6b
---
A files/ssl/star.star.beta.wmflabs.org.crt
M modules/role/manifests/cache/ssl/unified.pp
M modules/tlsproxy/manifests/localssl.pp
M modules/tlsproxy/templates/localssl.erb
4 files changed, 28 insertions(+), 4 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/87/247587/1
diff --git a/files/ssl/star.star.beta.wmflabs.org.crt
b/files/ssl/star.star.beta.wmflabs.org.crt
new file mode 100644
index 0000000..18a621f
--- /dev/null
+++ b/files/ssl/star.star.beta.wmflabs.org.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDUzCCAjugAwIBAgIJAPQqWZMjrev6MA0GCSqGSIb3DQEBCwUAMEAxHzAdBgNV
+BAoMFldpa2ltZWRpYSBiZXRhIGNsdXN0ZXIxHTAbBgNVBAMMFCouKi5iZXRhLndt
+ZmxhYnMub3JnMB4XDTE1MTAyMDE1MDQ1OVoXDTE2MTAxOTE1MDQ1OVowQDEfMB0G
+A1UECgwWV2lraW1lZGlhIGJldGEgY2x1c3RlcjEdMBsGA1UEAwwUKi4qLmJldGEu
+d21mbGFicy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTm0mN
+PHlyyTlq0TNtEs07n/YwMGmPk/qHqOQlNYODIpzdB7w/FxdD02t3I6mCwlfHIsyn
+N5ICmzWO205XvRZkRzrQgwDzFG9SxVM+aDipaXsQ8ZXEGTc0AJXoT1Q9kPK17/Qp
+hcCpUAy09IpXCyySCbIp2LnBWDkQSJ1mZagj0ryIrpLKbUfe3gGGJZw6QDJV2kKt
+iyag9RM0En7DfHRz9apfuvPHD43J1iTwqyxxw181l9qo+ZzHOInyg1r3iei++Vlx
+IfmIyKQqd/n3tiRtbVrFRxzF+QgyjLA1sXO3nW6lR/HOn7rZnwxGuT9bYASNKdUW
+wbohT7/LGOu7U8aNAgMBAAGjUDBOMB0GA1UdDgQWBBQT9uIv3fhtkR/sGdiMI5De
+KDSZ2TAfBgNVHSMEGDAWgBQT9uIv3fhtkR/sGdiMI5DeKDSZ2TAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCb/8eadshc4aYQERSLW3+qHHFuxXQHb52e
+9+JaE7dAj8+fD4px1IO2rzhgNWtMivgSaRuMZkW0eKEhnRS/OtjzIX283bU0Xrbm
+hdjs1zWtpMaRjRIGLW3rJRx3VUuZSauXLr8y6N5pcqtr4g7ZIzDq4mzoKSeJ6wcB
+0EKRdiMtCv5JRO/b87oSCtWNd0TD4VnpoMcqUFsBG9+V7TzOBVFbSRzJmNc1A78E
+1vLOKUPnO8UX/UQe48y7VGLxrkRc47Bfr+nFHHBuXcaFLjWkz1XmoSeFhPirWTc+
+3VmpiyyGXMx+f5bw+RpgwnRbLS+no+UJ17cfqo2GgeFqUfHRCI0D
+-----END CERTIFICATE-----
diff --git a/modules/role/manifests/cache/ssl/unified.pp
b/modules/role/manifests/cache/ssl/unified.pp
index 3136b4b..45f20a3 100644
--- a/modules/role/manifests/cache/ssl/unified.pp
+++ b/modules/role/manifests/cache/ssl/unified.pp
@@ -13,10 +13,10 @@
}
else {
tlsproxy::localssl { 'unified':
- certs => ['star.wmflabs.org'],
+ certs => ['star.star.beta.wmflabs.org'],
default_server => true,
do_ocsp => false,
- skip_private => true,
+ chain => false,
}
}
diff --git a/modules/tlsproxy/manifests/localssl.pp
b/modules/tlsproxy/manifests/localssl.pp
index 09b03fe..68be92a 100644
--- a/modules/tlsproxy/manifests/localssl.pp
+++ b/modules/tlsproxy/manifests/localssl.pp
@@ -35,7 +35,7 @@
$default_server = false,
$upstream_port = '80',
$do_ocsp = false,
- $skip_private = false,
+ $chain = true,
) {
require tlsproxy::instance
@@ -49,7 +49,7 @@
}
sslcert::certificate { $certs:
- skip_private => $skip_private,
+ chain => $chain,
}
if $do_ocsp {
diff --git a/modules/tlsproxy/templates/localssl.erb
b/modules/tlsproxy/templates/localssl.erb
index a52b4df..f8212ef 100644
--- a/modules/tlsproxy/templates/localssl.erb
+++ b/modules/tlsproxy/templates/localssl.erb
@@ -12,7 +12,11 @@
access_log off;
<% @certs.each do |cert| -%>
+ <% if @chain -%>
ssl_certificate /etc/ssl/localcerts/<%= cert %>.chained.crt;
+ <% else -%>
+ ssl_certificate /etc/ssl/localcerts/<%= cert %>.crt;
+ <% end -%>
ssl_certificate_key /etc/ssl/private/<%= cert %>.key;
<% end -%>
<% if @do_ocsp -%>
--
To view, visit https://gerrit.wikimedia.org/r/247587
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I450316d795046ed49d057b221433ce9b172b9d6b
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Alex Monk <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
