Change favorite certificate CLI

federico.ballarini · May 11, 2018, 4:42pm

NethServer Version: 7.4
Module: Server Certificate

Hi,
how can I change Nethserver favorite certificate from command line?
I am writing a script, because NS doesn’t update certificates if there is a proxy pass set for this domain…
And how often I have to update certs?

Thanks.

P.S. An OT question… NS 7.5 is released for testing or I can update on production servers?

mrmarkuz · May 11, 2018, 8:36pm

Here are some docs:
http://docs.nethserver.org/projects/nethserver-devel/en/v7/certificate_management.html

Here is a discussion about cert scripting:

federico.ballarini · May 11, 2018, 8:39pm

Thank you so much

davidep · May 11, 2018, 8:57pm

Did you update the nethserver-httpd-proxypass package to latest version? It should allow virtual host reverse proxy with a local LE certificate… If it does not work it’s a Bug!

See

http://docs.nethserver.org/en/v7/proxy_pass.html#reverse-proxy

And also

federico.ballarini · May 11, 2018, 9:14pm

If I use this and not a .conf file NS is able to update https certs?

davidep · May 11, 2018, 9:15pm

Yep! Certificates are updated by certbot (letsencrypt)

federico.ballarini · May 11, 2018, 9:24pm

Now i have a .conf file. Why it doesn’t update letsencrypt certs?

davidep · May 11, 2018, 9:29pm

It probably blocks the LE challenge path. Look at

github.com

NethServer/nethserver-httpd/blob/master/default/etc/e-smith/templates/httpd/proxy-extra/30ProxyPass

    # Reverse Proxy (with exclusion of local Letsencrypt challenge path)
    ProxyPassMatch ^/.well-known/acme-challenge/ !
    ProxyPass  / { ($OUT = $Target) =~ s|/*$|/| } max=3 retry=30
    ProxyPassReverse / { ($OUT = $Target) =~ s|/*$|/| }

federico.ballarini · May 11, 2018, 9:30pm

Thanks. I will try with NS httpd-admin.
Thank you so much.

davidep · May 11, 2018, 9:34pm

I can’t assert it’s a good test case I’d rather try with roundcube or a static web site…

federico.ballarini · May 11, 2018, 9:37pm

Sorry… I will try to remove .conf file and put info in NS httpd-admin

federico.ballarini · May 11, 2018, 9:55pm

A question… do you think that I have to “Accept invalid SSL certificate from target”?
In my project I don’t want to update SSL internal server certificates…
@davidep I hope in your advice… thanks.

davidep · May 12, 2018, 7:59am

If you don’t fear MITM attacks why not… In LAN can be acceptable also clear text protocol.