Pin certificate server key type to RSA #18
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
simonrw
approved these changes
Aug 21, 2023
| @@ -11,7 +11,7 @@ chmod 600 gandi.ini | |||
|
|
|||
| # request certificate | |||
| set -x | |||
| certbot -n --agree-tos --email ${CERTBOT_EMAIL} ${CERTBOT_ARGS} --authenticator dns-gandi --dns-gandi-credentials gandi.ini --work-dir=$PWD/work --config-dir=$PWD/config --logs-dir=$PWD/logs -d $certificate_domains certonly | |||
| certbot -n --agree-tos --email ${CERTBOT_EMAIL} ${CERTBOT_ARGS} --authenticator dns-gandi --dns-gandi-credentials gandi.ini --key-type rsa --work-dir=$PWD/work --config-dir=$PWD/config --logs-dir=$PWD/logs -d $certificate_domains certonly | |||
There was a problem hiding this comment.
minor: do we have any control over how many bits the rsa key uses? It would be good to ensure a secure amount, though I suppose it doesn't really matter for this use case...
There was a problem hiding this comment.
We can set it with --rsa-key-size, but I also do not quite see the need here.
Also, we should start moving to ECDSA as soon as we get rid of the libary anyway, then the defaults are 256bit, which should be good currently.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Currently, our certificate workflow would use the certbot default - ECDSA, as generated server key.
However, this breaks LocalStack's EKS implementation, since it seems our proxy implementation does not like ECDSA public keys, and will somehow break the client certificates necessary for authentication with the k3s API.
It will lead to the following errors in k3s:
For now, we need to pin an RSA server key to avoid breaking behavior, until we can replace the proxy library (necessary for python3.11 as well).
Changes