Register certificates in the mirror
To work with certificates in the mirror, you can:
- import your certificate at the mirror initialization stage in a closed loop (init, bundle make);
- import your certificate at the nginx deployment stage for external nexus in a closed loop;
- apply a separate command
stm cert import, into which you need to substitute your own parameter values.
Commands and available parameters for working with certificates
| Command | Command description | Parameter | Description of parameter |
|---|---|---|---|
| stm cert import | Import certificate (will restart the mirror) | --cert-file | Certificate file to import |
| --privkey-file | Key file to import | ||
| stm cert csr | Generate a request for a certificate | --fqdn | Address to which the request will be generated |
Examples:
Command for generating a certificate request
# The CSR and key will be saved in the export directory
stm cert csr --fqdn=mirror.corpdomain.ru
Command to issue a certificate using the CSR and your CA (for openssl)
Please note! For the commands to work correctly, you will need OpenSSL version no lower than 3.0.
openssl x509 -req -sha512 -in export/csr.pem -days 3650 -CA ca/ca_cert.pem -CAkey ca/ca_private_key.pem -CAcreateserial -out export/mirror_cert.pem -copy_extensions copyall
# Append your CA to the issued certificate
cat ca/ca_cert.pem >> export/mirror_cert.pem
Command to import a certificate when the mirror is already initialized
Executing the command will restart the mirror
stm cert import --cert-file export/mirror_cert.pem --privkey-file export/privkey.pem
Certificate requirement
- To import, you must specify a file with a certificate chain and a key;
- Certificates and key must be in pem format;
- The certificate chain must contain ca and the certificate itself;
- The certificate must contain a subjectAltName field with the mirror fqdn (fqdn must match the specified –fqdn parameter or the value in the mirror configuration) or wildcard domain (must match the mirror domain);
- When issuing a certificate using CSR, you must save Extensions (for openssl the key is
-copy_extensionscopyall).
Obtaining a certificate from the Acme server (step-ca)
The mirror control module itself does not support working with the Acme server. It is possible to set up receiving a certificate from Acme using certbot. To do this you need:
- Stop the container with the mirror
Command
podman stop shturval_proxy
or
stm stop
- Request a certificate
Command
REQUESTS_CA_BUNDLE=PATH_TO_ROOT_CA_CERTIFICATE certbot certonly -d CERTIFICATE_FQDN --server ACME_SERVER_ADDRESS --standalone --agree-tos -m EMAIL
Example
REQUESTS_CA_BUNDLE=/home/shturval/root_ca.crt certbot certonly -d mirror.ip-10-11-12-132.shturval.link --server https://issuer.ip-10-11-12-3.shturval.link:9443/acme/acme/directory --standalone --agree-tos -m user@lab.ru
- Copy certificates to the mirror directory
Command
cp /etc/letsencrypt/live/CERTIFICATE_FQDN/fullchain.pem PATH_TO_MIRROR/config/certs/dst.pem
cp /etc/letsencrypt/live/CERTIFICATE_FQDN/fullchain.pem PATH_TO_MIRROR/config/certs/fullchain.pem
cp /etc/letsencrypt/live/CERTIFICATE_FQDN/privkey.pem PATH_TO_MIRROR/config/certs/privkey.pem
#Example
cp /etc/letsencrypt/live/mirror.ip-10-31-145-132.shturval.link/fullchain.pem /home/shturval/shturval-mirror/config/certs/dst.pem
cp /etc/letsencrypt/live/mirror.ip-10-31-145-132.shturval.link/fullchain.pem /home/shturval/shturval-mirror/config/certs/fullchain.pem
cp /etc/letsencrypt/live/mirror.ip-10-31-145-132.shturval.link/privkey.pem /home/shturval/shturval-mirror/config/certs/privkey.pem
- Launch a mirror
Command
podman start shturval_proxy
or
stm start
- Delete tasks created by Certbot
Command
systemctl stop certbot.timer
systemctl disable certbot.timer
- Add a certificate update script to the tasks (cron, systemd timer) (previously edited for your installation)
Command
#!/bin/bash
# Edit the values for your installation
REQUESTS_CA_BUNDLE=/home/shturval/root_ca.crt # Path to the root CA certificate file
DIRECTORY_URL=https://issuer.ip-10-11-12-3.shturval.link:9443/acme/acme/directory # ACME server address
DOMAIN_NAME=mirror.ip-10-11-12-132.shturval.link # Certificate FQDN
MIRROR_PATH=/home/shturval/shturval-mirror # Path to the mirror directory
# Edit only if you changed the default values
NGINX_CONTAINER_NAME=shturval_proxy # nginx container name
PODMAN_BIN=/usr/local/bin/podman # Path to podman
${PODMAN_BIN} stop ${NGINX_CONTAINER_NAME}
REQUESTS_CA_BUNDLE=$REQUESTS_CA_BUNDLE certbot -q renew --server ${DIRECTORY_URL}
cp -f /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem ${MIRROR_PATH}/config/certs/dst.pem
cp -f /etc/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem ${MIRROR_PATH}/config/certs/fullchain.pem
cp -f /etc/letsencrypt/live/${DOMAIN_NAME}/privkey.pem ${MIRROR_PATH}/config/certs/privkey.pem
${PODMAN_BIN} start ${NGINX_CONTAINER_NAME}