ACME Docs and changes in Functions.run_bash
This commit is contained in:
Joao Gilberto Magalhaes
parent
014f83332c
commit
9db4d763ec
13 changed files with 127 additions and 99 deletions
36
docs/acme.md
Normal file
36
docs/acme.md
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# SSL - Automatic Certificate Management Environment (ACME)
|
||||
|
||||
The Automatic Certificate Management Environment (ACME) protocol
|
||||
allow automating interactions between certificate authorities and their users' servers,
|
||||
allowing the automated deployment of public key infrastructure.
|
||||
|
||||
Most of the issuers offers Automatic Issuing free of cost.
|
||||
|
||||
To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting up to 4 environment variables:
|
||||
|
||||
- EASYHAPROXY_CERTBOT_AUTOCONFIG (optional): Will use pre-sets for your Certificate Authority (CA). See table below.
|
||||
- EASYHAPROXY_CERTBOT_EMAIL (required): Your email in the certificate authority.
|
||||
- EASYHAPROXY_CERTBOT_SERVER (optional): The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below.
|
||||
- EASYHAPROXY_CERTBOT_EAB_KID (optional): External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below.
|
||||
- EASYHAPROXY_CERTBOT_EAB_HMAC_KEY (optional): External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below.
|
||||
|
||||
Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know.
|
||||
|
||||
| CA | Auto Config | Free? | Account Required? | EAB KID? | EAB HMAC Key? | More Info |
|
||||
|----------------------|------------------|-------|--------------------|----------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Let's Encrypt | - | Yes | No | No | No | [Link](letsencrypt.md) |
|
||||
| Let's Encrypt (Test) | letsencrypt_test | Yes | No | No | No | [Link](letsencrypt.md) |
|
||||
| ZeroSSL | zerossl | Yes | No | No | No | [Link](https://zerossl.com/documentation/acme/) |
|
||||
| BuyPass | buypass | Yes | No | No | No | [Link](https://community.buypass.com/t/63d4ay/buypass-go-ssl-endpoints-updated-14-05-2020) |
|
||||
| BuyPass (test) | buypass_test | Yes | No | No | No | [Link](https://community.buypass.com/t/63d4ay/buypass-go-ssl-endpoints-updated-14-05-2020) |
|
||||
| Google | google | Yes | Yes | Yes | Yes | [Link](https://cloud.google.com/blog/products/identity-security/automate-public-certificate-lifecycle-management-via--acme-client-api) |
|
||||
| Google Test | google_test | Yes | Yes | Yes | Yes | [Link](https://cloud.google.com/blog/products/identity-security/automate-public-certificate-lifecycle-management-via--acme-client-api) |
|
||||
| SSLCOM RCA | sslcom_rca | Yes | No. Keys by email. | Yes | Yes | [Link](https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/) |
|
||||
| SSLCOM ECC | sslcom_ecc | Yes | No. Keys by email. | Yes | Yes | [Link](https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/) |
|
||||
| Digicert | - | No | Yes | Yes | Yes | [Link](https://docs.digicert.com/en/certcentral/certificate-tools/certificate-lifecycle-automation-guides/use-a-third-party-acme-client-for-host-automations.html) |
|
||||
| Entrust | - | No | Yes | Yes | Yes | [Link](https://www.entrust.com/knowledgebase/ssl/how-to-use-acme-to-install-ssl-tls-certificates-in-entrust-certificate-services-apache) |
|
||||
| Sectigo | - | No | Yes | Yes | Yes | [Link](https://www.sectigo.com/resource-library/sectigos-acme-automation) |
|
||||
|
||||
This configuration is global. After set up ACME properly, is necessary enable for each domain the certificate request.
|
||||
|
||||
To do that add the label: `easyhaproxy.<definition>.certbot=true`. See the method of installation you are using to learn how to set up properly.
|
||||
|
|
@ -12,7 +12,7 @@
|
|||
| easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if `certbot` is enabled. | *empty* | base64 cert + key |
|
||||
| easyhaproxy.[definition].ssl | (Optional) If `true` you need to provide certificate as a file. See below. Do not use with `sslcert`. | false | true or false |
|
||||
| easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` | *empty* | ssl |
|
||||
| easyhaproxy.[definition].certbot | (Optional) Generate certificate with certbot. Do not use with `sslcert` parameter. | false | true OR false |
|
||||
| easyhaproxy.[definition].certbot | (Optional) Generate certificate with certbot. Do not use with `sslcert` parameter. More info [here](acme.md). | false | true OR false |
|
||||
| easyhaproxy.[definition].redirect_ssl | (Optional) Redirect all requests to https | false | true OR false |
|
||||
| easyhaproxy.[definition].clone_to_ssl | (Optional) It copies the configuration to HTTPS(443) and disable SSL from the current config. **Do not use* this with `ssl` or `certbot` parameters | false | true OR false |
|
||||
|
||||
|
|
|
|||
|
|
@ -54,13 +54,9 @@ Please follow the [docker label configuration](container-labels.md) to see other
|
|||
You can configure the behavior of the EasyHAProxy by setup specific environment variables. To get a list of the variables, please follow the [docker container environment](docker-environment.md)
|
||||
|
||||
|
||||
## Setup certificates with Letsencrypt
|
||||
## Setup certificates with ACME (e.g. Letsencrypt)
|
||||
|
||||
Follow [this link](letsencrypt.md)
|
||||
|
||||
## Setup certificates with ZeroSSL
|
||||
|
||||
Follow [this link](zerossl.md)
|
||||
Follow [this link](acme.md)
|
||||
|
||||
## Setup your own certificates
|
||||
|
||||
|
|
|
|||
|
|
@ -90,7 +90,7 @@ Caveats:
|
|||
|
||||
**Important**: The annotations are per ingress and applied to all hosts in that ingress configuration.
|
||||
|
||||
## Letsencrypt
|
||||
## Certbot / ACME / Letsencrypt
|
||||
|
||||
It is necessary add the annotation `easyhaproxy.certbot` to the ingress configuration:
|
||||
|
||||
|
|
@ -106,7 +106,9 @@ spec:
|
|||
....
|
||||
```
|
||||
|
||||
Make sure your cluster is accessible both through ports 80 and 443.
|
||||
More info [here](acme.md).
|
||||
|
||||
Make sure your cluster is accessible both through ports 80 and 443.
|
||||
|
||||
## Custom SSL Certificates
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Setup custom certificates
|
||||
|
||||
You can use your certificates with EasyHAProxy.
|
||||
You can use your own certificates with EasyHAProxy. You just need to let EasyHAProxy know that certificate.
|
||||
|
||||
There are two ways to do that.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,70 +0,0 @@
|
|||
# ZeroSSL
|
||||
|
||||
EasyHAProxy can issue a ZeroSSL certificate. Follow the steps below:
|
||||
|
||||
## Getting the Keys from ZeroSSL
|
||||
|
||||
- Login to [ZeroSSL](https://zerossl.com?fpr=byjg)
|
||||
- If you don't have an account you can use our referral link: [https://zerossl.com?fpr=byjg](https://zerossl.com?fpr=byjg)
|
||||
- If you created recently and would like to support us open an issue, and I'll try to add you as our referred.
|
||||
- In the ZeroSSL dashboard click in 'Developer' and the Generate EAB Keys
|
||||
|
||||
|
||||
|
||||
- Once you generate the keys, please **take note**. We will need this later, and it isn't saved anywhere.
|
||||
|
||||
|
||||
|
||||
```text
|
||||
Important: if you to this process again the old values will be lost and you need to setup EasyHAProxy again.
|
||||
```
|
||||
|
||||
## Setting up EasyHAProxy
|
||||
|
||||
Run the EasyHAProxy container with the following parameters:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
... \
|
||||
-e EASYHAPROXY_CERTBOT_EMAIL="your zerossl email" \
|
||||
-e EASYHAPROXY_CERTBOT_EAB_KID="the eab_kid from the previous step" \
|
||||
-e EASYHAPROXY_CERTBOT_EAB_HMAC_KEY="the eab_hmac_key from the previous step" \
|
||||
-e EASYHAPROXY_CERTBOT_SERVER="https://acme.zerossl.com/v2/DV90" \
|
||||
-p 80:80 \
|
||||
-p 443:443 \
|
||||
-v /path/to/guest/certbot/certs:/certs/certbot \
|
||||
... \
|
||||
byjg/easy-haproxy
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- If you don't setup all `EASYHAPROXY_CERTBOT_*` environment variables with the proper values, EasyHAProxy will fail silently and **will not request** a certificate.
|
||||
- The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/)
|
||||
|
||||
**It is required you to persist the container folder `/certs/certbot` outside the container.**
|
||||
|
||||
You cannot delete or change it contents.
|
||||
If you do not persist, or change/delete the contents, Let's encrypt will not work properly.
|
||||
|
||||
|
||||
## Setting up your container to use ZeroSSL
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
... \
|
||||
--label easyhaproxy.express.port=80 \
|
||||
--label easyhaproxy.express.localport=3000 \
|
||||
--label easyhaproxy.express.host=example.org \
|
||||
--label easyhaproxy.express.certbot=true \
|
||||
... \
|
||||
some/myimage
|
||||
```
|
||||
|
||||
Requirements:
|
||||
|
||||
- Your container **must** listen to port 80. Letsencrypt will not issue the certificate if `easyhaproxy.<definition>.port` is in another port, and EasyHAProxy will fail silently.
|
||||
- You cannot set port 443 for the container with the Letsencrypt because EasyHAProxy will create this port automatically once the certificate is issued.
|
||||
|
||||
----
|
||||
[Open source ByJG](http://opensource.byjg.com)
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 97 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
Loading…
Add table
Add a link
Reference in a new issue