Add certs plugin for certificate management #1414

michaelshobbs · 2015-08-24T21:16:44Z

TODOS:

remove 'magically' added VHOST entries based on SSL cert information
implement certs plugin 'loosely' based on https://devcenter.heroku.com/articles/ssl-endpoint
- only implements certs:remove, certs:info and certs:generate (if someone wants to take a stab at the others, please feel free)
document certs plugin
document private/shared functions convention for plugins

Note:

further implements cross-plugin function sharing. as a convention, we've seem to have settled on shareable functions residing in <plugin_path>/functions and non-shareable functions residing in <plugin_path>/commands (example here)

example certs:info output

root@dokku:~/dokku# dokku certs:info node-js-app
-----> Fetching SSL Endpoint info for node-js-app...
-----> Certificate details:
=====> Common Name(s):
=====>    test.dokku.me
=====>    www.test.dokku.me
=====>    www.test.app.dokku.me
=====> Expires At: Jan 14 17:57:12 2017 GMT
=====> Issuer: C=US, ST=California, L=San Francisco, OU=Dokku Me, LLC, CN=test.dokku.me
=====> Starts At: Jan 15 17:57:12 2015 GMT
=====> Subject: C=US; ST=California; L=San Francisco; OU=Dokku Me, LLC; CN=test.dokku.me
=====> SSL certificate is self signed.

michaelshobbs · 2015-08-24T21:22:40Z

plugins/certs/commands

working on implementation now

Please update the docs as well to illustrate how this will work.

For sure. I meant to add a task to redo the entirety of the docs for this; including the "public functions convention.

josegonzalez · 2015-08-25T15:40:43Z

Output of certs:info:

jose@mactaku:~/Apps/seatgeek/app git:master $ heroku certs:info
Fetching SSL Endpoint some-endpoint.herokussl.com info for app... done
Certificate details:
Common Name(s): *.domain.com
                domain.com

Expires At:     2019-03-15 05:45 UTC
Issuer:         ISSUER_DATA
Starts At:      2014-12-21 21:24 UTC
Subject:        SUBJECT_DATA
SSL certificate is verified by a root authority.

michaelshobbs · 2015-08-25T23:45:52Z

@josegonzalez this is ready to be banged on. review away

josegonzalez · 2015-08-25T23:54:28Z

GTFO tests fail.

Let me see what I can do to test it. I have a wildcard cert somewhere...

josegonzalez · 2015-08-25T23:56:31Z

docs/application-deployment.md

@michaelshobbs I think you ran git cherry-pick in the wrong branch.

i rebased master

josegonzalez · 2015-08-26T00:08:34Z

So is the expectation that people only be able to use self-signed certs with this plugin?

michaelshobbs · 2015-08-26T00:27:43Z

No. See docs for the generate command. We place the SS cert in place and then you can replace it when you get your real cert back if you decide to go that route.

josegonzalez · 2015-08-26T00:29:41Z

How does someone replace the cert?

michaelshobbs · 2015-08-26T00:30:39Z

RTFM man!! 😄

from the new docs

If you decide to obtain a CA signed certficate, simply place it in 
`$DOKKU_ROOT/$APP/tls/server.crt` and run `dokku nginx:build-config $APP`.

josegonzalez · 2015-08-26T00:39:30Z

I mean shouldn't we remove the nginx version of adding certs then? Seems like that's unnecessary duplication.

michaelshobbs · 2015-08-26T00:58:24Z

so that's a way to import a cert. which doesn't follow the heroku certs ui. hence i didn't use. that's a benefit of using something like ruby (?) for the client. not sure how to pipe in a key and cert file via an ssh connection

josegonzalez · 2015-08-26T01:01:23Z

Lets assume that we don't have to support ssh. Would it then be fine to include that functionality in here and rip it out of the old place?

michaelshobbs · 2015-08-26T01:33:25Z

sure. the current implementation is a bit hokey. would you want to implement the same heroku ui?

i.e.:

certs:add CRT KEY            #  Add an ssl endpoint to an app.

josegonzalez · 2015-08-26T02:00:27Z

Yeah, I think so?

Also move into subdirectory [ci skip]

josegonzalez · 2015-09-04T03:39:22Z

Okay, I:

rebased the pr, wooter scooter!
moved the existing nginx:import-ssl command to certs:add.
updated the ssl docs to be much more comprehensive.
removed old docs in the nginx.md file.

How do you set multiple ssl certs? I don't think thats possible at all, despite what the docs said. Can someone verify that to be the case? I don't see how, given that we hardcode the location of server.crt and server.key. Personally I am okay with this, but we need to be very clear about this.

michaelshobbs · 2015-09-04T03:48:44Z

Multiple certs were never supported

[ci skip]

josegonzalez · 2015-09-04T03:56:48Z

The following heroku commands are left unimplemented:

certs:chain CRT [CRT ...], Print the ordered and complete chain for the given certificate.
certs:key CRT KEY [KEY ...], Print the correct key for the given certificate.
certs:rollback, Rollback an SSL Endpoint for an app.
certs:update CRT KEY, Update an SSL Endpoint on an app.

The rollback one isn't worth attempting to implement, and I think certs:update can be used as an alias for certs:add in our case. What do you think of the other two?

This can be used as an alternative to importing via stdin, which may be preferred when working directly on a server, or via scripted installation/deployments.

If a command will exit because of invalid input, that isn't a warning, it's a failure.

josegonzalez · 2015-09-04T04:20:16Z

I've implemented crt/key importing via files on disk vs tarball. I think if tests pass, we can safely merge this in, as I have no intention of implementing any of the others (and they can be implemented in the future if need be).

Thoughts (before you head off to the wilderness)?

michaelshobbs · 2015-09-04T04:34:00Z

Works for me. key and chain didn't make sense to me as i wasn't sure how to implement with openssl. if someone else wants to take a stab, go for it.

michaelshobbs · 2015-09-04T04:41:03Z

plugins/certs/commands

you'll want a space here between $KEY_FILE and ]] 😄

Otherwise `make addman` will fail during test runs

[ci skip]

josegonzalez · 2015-09-04T17:26:41Z

Merging!

certs plugin

michaelshobbs reviewed Aug 24, 2015
View reviewed changes

michaelshobbs force-pushed the 1368_mh-certs-plugin branch 2 times, most recently from 509e0ce to e01890f Compare August 25, 2015 02:32

josegonzalez added the bc-break label Aug 25, 2015

michaelshobbs changed the title ~~[WIP] certs plugin~~ certs plugin Aug 25, 2015

josegonzalez reviewed Aug 25, 2015
View reviewed changes

michaelshobbs force-pushed the 1368_mh-certs-plugin branch from 2c3ca22 to a43fb8d Compare August 26, 2015 00:28

josegonzalez added the 0.4.0 label Aug 26, 2015

This was referenced Aug 26, 2015

Don’t automatically configure certificate’s CN and SANs as domains #1368

Closed

nginx:import-ssl should be able to import multiple pairs at once #1195

Closed

michaelshobbs self-assigned this Sep 1, 2015

michaelshobbs added 5 commits September 3, 2015 22:35

remove magic additions to VHOST based on SSL cert. fixes #1368

a983456

initial pass at cert plugin functionality

f9da2d5

heroku-like certs:info output

aec138e

implement certs:remove. spit out csr on certs:generate

983e091

document certs plugin

5378337

michaelshobbs added 2 commits September 3, 2015 22:35

document 'public' functions convention

8ea5cfa

lintball. also run nginx:build-config if domains:add fails

5cb62b1

josegonzalez force-pushed the 1368_mh-certs-plugin branch from a43fb8d to 5cb62b1 Compare September 4, 2015 02:35

josegonzalez added 4 commits September 3, 2015 22:38

[ci skip] minor formatting changes

f2e1537

Move nginx:import-ssl to certs:add

d37e64d

Update documentation on ssl management

db4e847

Also move into subdirectory [ci skip]

Update note on replacing certificate

148d563

Update documentation regarding multiple ssl certificate usage

1371056

[ci skip]

josegonzalez added 4 commits September 4, 2015 00:00

Add certs:update alias for certs:add

71ebf1e

Add support for certificate setting via files on disk (when on server)

76cf4d2

This can be used as an alternative to importing via stdin, which may be preferred when working directly on a server, or via scripted installation/deployments.

Use dokku_log_fail in all cases where there is an exit 1

95161a2

Use dokku_log_fail in favor of dokku_log_warn

adfc3a8

If a command will exit because of invalid input, that isn't a warning, it's a failure.

michaelshobbs reviewed Sep 4, 2015
View reviewed changes

plugins/certs/commands Outdated

Copy link

Member Author

michaelshobbs Sep 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you'll want a space here between $KEY_FILE and ]] 😄

michaelshobbs and others added 3 commits September 3, 2015 21:44

lintballs

515afa8

Move version into place before running copyfiles

3c894fd

Otherwise `make addman` will fail during test runs

Re-add old ssl docs while 0.4.0 is still not released

d50db13

[ci skip]

josegonzalez added a commit that referenced this pull request Sep 4, 2015

Merge pull request #1414 from progrium/1368_mh-certs-plugin

7a1c080

certs plugin

josegonzalez merged commit 7a1c080 into master Sep 4, 2015

josegonzalez deleted the 1368_mh-certs-plugin branch September 4, 2015 17:26

josegonzalez changed the title ~~certs plugin~~ Add certs plugin for certificate management Sep 15, 2015

josegonzalez unassigned michaelshobbs Dec 6, 2015

josegonzalez added merge-level: minor and removed bc-break labels Jul 17, 2020

Uh oh!

Add certs plugin for certificate management #1414

Add certs plugin for certificate management #1414

Uh oh!

Conversation

michaelshobbs commented Aug 24, 2015

Uh oh!

michaelshobbs Aug 24, 2015

Choose a reason for hiding this comment

Uh oh!

josegonzalez Aug 24, 2015

Choose a reason for hiding this comment

Uh oh!

michaelshobbs Aug 24, 2015

Choose a reason for hiding this comment

Uh oh!

josegonzalez commented Aug 25, 2015

Uh oh!

michaelshobbs commented Aug 25, 2015

Uh oh!

josegonzalez commented Aug 25, 2015

Uh oh!

josegonzalez Aug 25, 2015

Choose a reason for hiding this comment

Uh oh!

michaelshobbs Aug 26, 2015

Choose a reason for hiding this comment

Uh oh!

josegonzalez commented Aug 26, 2015

Uh oh!

michaelshobbs commented Aug 26, 2015

Uh oh!

josegonzalez commented Aug 26, 2015

Uh oh!

michaelshobbs commented Aug 26, 2015

Uh oh!

josegonzalez commented Aug 26, 2015

Uh oh!

michaelshobbs commented Aug 26, 2015

Uh oh!

josegonzalez commented Aug 26, 2015

Uh oh!

michaelshobbs commented Aug 26, 2015

Uh oh!

josegonzalez commented Aug 26, 2015

Uh oh!

josegonzalez commented Sep 4, 2015

Uh oh!

michaelshobbs commented Sep 4, 2015

Uh oh!

josegonzalez commented Sep 4, 2015

Uh oh!

josegonzalez commented Sep 4, 2015

Uh oh!

michaelshobbs commented Sep 4, 2015

Uh oh!

michaelshobbs Sep 4, 2015

Choose a reason for hiding this comment

Uh oh!

josegonzalez commented Sep 4, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants