Added CUSTOM_CERT_DIR and ad-hoc self signed cert generation#27
Added CUSTOM_CERT_DIR and ad-hoc self signed cert generation#27richturner wants to merge 4 commits into
Conversation
richturner
changed the title
|
|
||
| # Generate a new certificate valid for 365 days | ||
| openssl req -x509 -nodes -newkey rsa:2048 -sha256 -days 365 \ | ||
| -subj "/CN=localhost" \ |
There was a problem hiding this comment.
@richturner Shouldn't this be OR_HOSTNAME? From what I understand around the usage of OR_HOSTNAME, this function will be ran if OR_HOSTNAME is not an FQDN, so using localhost could block people from properly using it on other domain names.
There was a problem hiding this comment.
@pankalog no the purpose of the self signed certificate is just as a final fallback if SNI fails to match a specific cert, it is bad practice to present a valid public FQDN in this scenario, this just replaces the previous selfsigned cert that was baked in
|
richturner
changed the title
2 participants
It wasn't possible to volume map in an additional directory of custom SSL certificates, with this change it is now easy to volume map the
deployment-datavolume to/dataand load custom certs from/data/proxy/certs.By generating the self signed cert on the fly at startup we avoid needing to renew it in the repo itself.