Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move ssl handling to use a more 'acme' way of doing things #363

Closed
ErisDS opened this issue Jul 17, 2017 · 1 comment · Fixed by #371
Closed

Move ssl handling to use a more 'acme' way of doing things #363

ErisDS opened this issue Jul 17, 2017 · 1 comment · Fixed by #371
Assignees

Comments

@ErisDS
Copy link
Member

ErisDS commented Jul 17, 2017

When we switched over to using acme.sh for letsencrypt, we kept as many things as possible the same as they were before.

However, acme.sh is able to do more of the heavy lifting than we are using it for.

I propose that we remove our own handling of ssl renewal, in favour of depending upon acme.sh to do this itself.

The rationale here, is that acme.sh is a pretty well used and understood script, with great documentation. It stores all certificates in a standard, detectable place, and will automatically renew any certificates it knows about.

This means that when users have more advanced use cases, such as needing to manage multiple certificates, ghost cli won't need to step in, but instead we can point users at acme for all of their ssl needs.

E.g. if you have multiple custom domains, and need to setup SSL redirects from secondary domains to the canonical domain, it will be possible to do so using acme.sh

This will also get rid of the crontab library and close #348 automatically.

This change should result in less code overall, and more interoperability/compatibility between ghost-cli and acme.

In addition, I think it may be a good idea to symlink the fullchain and private keyfiles into the ghost/system folder, rather than copying them. Not sure what the implications might be here, but this will make it easier to understand where those files come from.

Discussion resulted in us changing this to linking direct to ~/.acme.sh/

@ErisDS
Copy link
Member Author

ErisDS commented Jul 17, 2017

It is worth noting, this will break ssl renewals for existing installs. We will do our best to document an extra command to run to fix it in as many places as possible to mitigate this.

acburdine added a commit to acburdine/Ghost-CLI that referenced this issue Jul 21, 2017
closes TryGhost#363, closes TryGhost#365, closes TryGhost#348, closes TryGhost#332, closes TryGhost#183
- move nginx configuration to templates
- rely on acme.sh for cronjobs, remove ssl-renew setup and command
- cleanup & simplify nginx setup
- add subdirectory support
acburdine added a commit to acburdine/Ghost-CLI that referenced this issue Jul 21, 2017
closes TryGhost#363, closes TryGhost#365, closes TryGhost#348, closes TryGhost#332, closes TryGhost#183
- move nginx configuration to templates
- rely on acme.sh for cronjobs, remove ssl-renew setup and command
- cleanup & simplify nginx setup
- add subdirectory support
acburdine added a commit that referenced this issue Jul 21, 2017
closes #363, closes #365, closes #348, closes #332, closes #183
- move nginx configuration to templates
- rely on acme.sh for cronjobs, remove ssl-renew setup and command
- cleanup & simplify nginx setup
- add subdirectory support
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants