ngcp-panel

Commit Graph

Author	SHA1	Message	Date
Mykola Malkov	a8476ad20d	MT#58444 Set correct permissions/ownership for ssl files Key and csr files should be 640. All other files 644. Ownership for all files should be root:ssl-cert. Change-Id: Ie4c0c8070d856d881b9d47aa65f953869537ee1e	6 months ago
Guillem Jover	0e5a529153	TT#177600 Move SSL certificates under /etc/ngcp-config/shared-files/ssl These are shared files across all PRO/Carrier nodes, but at the time they were introduced we did not have the concept of a shared-files subdirectory. All other such shared files have been moved over time to that subdirectory, but this was still remaining behind. Let's move it now for consistency, and so that its purpose is more clear. Change-Id: I05762d66c352b8ebee34ae93d952d9ffd58910fb	3 years ago
Manuel Montecelo	8f9f92eb68	TT#44919 Change "openssl genrsa" so it works with buster and older releases The interface of the "openssl genrsa" changed in Debian buster (10), and it doesn't accept "-config" or "-batch" any longer. It is not very clearly documented (or easy to find) how and when, because versions of 1.1.0 still work in the old way, but in 1.1.1 it doesn't. The new sub-command "genpkey" is supposed to supersede genrsa, but the output file is slightly different, genrsa having RSA in the BEGIN/END blocks, while genpkey not having info about the algorithm: -----BEGIN RSA PRIVATE KEY----- vs. -----BEGIN PRIVATE KEY----- This small change could bite us if we're parsing these files in some way, and I found comments complaining that some services do not like the "new" header if they are linked against older versions of openssl, so e.g. they (Exim in particular) fail to start. I found a way in which it works fine for both versions, by still using "genrsa" and passing the config file through an environment parameter, and removing -batch. After pondering about it for a bit, I prefer this solution to another one parsing the Debian release or openssl version and using one or other version accordingly, specially because of the lack of clarity of exactly when the versions had changed. The rest of the commands continue to accept -config and -batch, so in principle we do not need to change them, for the time being, but probably we will have to revisit them in the long run, specially if they keep breaking the interface without much of a fallback or clear warning. Change-Id: I495d8cccf120c5a2665d9843392fe580ec59f4bd	7 years ago
Victor Seva	3598a1dfc2	MT#19055 tools/generate_ssl_keys.sh: add ${KEY_FILE} to ssl-cert group too * kamailio now uses that file by default Change-Id: Id34e1232b542e9dd8be10b3719cdaaf2a627827e	9 years ago
Victor Seva	d938afb021	MT#16933 tools/generate_ssl_keys.sh: force days argument at x509 'default_days' value is at our opensslcnf.cnf but it seems that it is not been used Change-Id: Ibd4148c70c215340ac9053fa56c6a8f9247648db	10 years ago
Victor Seva	e7be026b32	MT#13949 generate_ssl_keys.sh: use ssl-cert group Change-Id: Ie19a606fbe81a6ec36df0e685a89e4f614b387f3	10 years ago
Alexander Lutay	fc73430dd2	MT#12591 Use root:www-data for default certificate file /etc/ngcp-config/ssl/myserver.crt Change-Id: I4192ecabb9e587508687085ca4be17ca57bfbfac	10 years ago
Michael Prokop	2b563f1730	MT#10181 generate_ssl_keys.sh: support skipping csr file generation Change-Id: I818e9c9168b5573a51878ca11f26d3f351c2f6ad	11 years ago
Michael Prokop	a3bb9f51e5	MT#10181 Rework SSL generation script to also generate CSR file Change-Id: Iad8c33a64d471a83acf81d12d2e0ea0403573b3c	11 years ago
Victor Seva	264a099113	MT#9547 generate_ssl_keys.sh: add third option to select the name of the certs produced Change-Id: I2f842376ad0eb904354879b39af24285ffde438a	11 years ago
Andreas Granig	629f215dae	MT#6695 Specify ssl config dir and document auth Allow to specify path to dir containing opensslcnf.cnf Document usage of basic auth for API	11 years ago
Victor Seva	ce63522627	MT#6815 create ngcp-panel-tools package Move the generate_ssl_keys.sh script there.	11 years ago

12 Commits (e66c568efcfeacb6ac95fc8b5ca749ef42d73d46)