Skip to content

Commit

Permalink
Updated files mentioning server.key and/or server.crt
Browse files Browse the repository at this point in the history
  • Loading branch information
charles-cowart committed May 31, 2023
1 parent 973f2a4 commit a9e5e6f
Show file tree
Hide file tree
Showing 5 changed files with 25 additions and 17 deletions.
24 changes: 16 additions & 8 deletions INSTALL.md
Original file line number Diff line number Diff line change
Expand Up @@ -397,16 +397,18 @@ In the event that you get `_tkinter.TclError: no display name and no $DISPLAY en
## Generating certs for individual Qiita installations

Qiita comes with a set of certs used for continuous integration (CI) tests. These certs are located in qiita_core/support_files/ and are not the certs used in production Qiita; they are for development use ONLY. When installing Qiita for development purposes you may wish to generate a set of certs and keys for your own use.
dd

### First, generate a new root CA private key and certificate:

First, generaet a new root CA private key and certificate:
`openssl req -x509 -sha256 -days 356 -nodes -newkey rsa:2048 -subj "/CN=localhost/C=US/L=San Diego" -keyout ci_rootca.key -out ci_rootca.crt`

Second, generate a new server private key:
### Second, generate a new server private key:

`openssl genrsa -out ci_server.key 2048`

Copy the following to a new file named csr.conf and modify to suit your needs
### Copy the following to a new file named csr.conf and modify to suit your needs

`[ req ]
default_bits = 2048
prompt = no
Expand All @@ -429,10 +431,12 @@ subjectAltName = @alt_names
DNS.1 = localhost
IP.1 = 127.0.0.1`

Next, generate a certificate signing request
### Next, generate a certificate signing request

`openssl req -new -key ci_server.key -out ci_server.csr -config csr.conf`

Copy the following to a new file named cert.conf and modify to suit your needs
### Copy the following to a new file named cert.conf and modify to suit your needs

`authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
Expand All @@ -441,14 +445,18 @@ subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost`

Lastly, generate a new server.crt that's signed with your root-CA certificate to use with your server.key
### Lastly, generate a new server.crt that's signed with your root-CA certificate to use with your server.key

`openssl x509 -req -in ci_server.csr -CA ci_rootca.crt -CAkey ci_rootca.key -CAcreateserial -out ci_server.crt -days 365 -sha256 -extfile cert.conf`

The contents of server.crt can be appended to certifi package's CA cache after which the CA cert won't need to be passed to QiitaClient objects and the like.
### The contents of server.crt can be appended to certifi package's CA cache after which the CA cert won't need to be passed to QiitaClient objects and the like.

Start python interactively and get location of cacert.pem

`import certifi
certifi.where()
'/Users/qiita_user/miniconda3/lib/python3.9/site-packages/certifi/cacert.pem'`

Append ci_rootca.crt to cacert.pem
### Append ci_rootca.crt to cacert.pem

`cat ci_rootca.crt >> '/Users/qiita_user/miniconda3/lib/python3.9/site-packages/certifi/cacert.pem'`
4 changes: 2 additions & 2 deletions qiita_core/configuration_manager.py
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,7 @@ def _get_main(self, config):
self.certificate_file = config.get('main', 'CERTIFICATE_FILE')
if not self.certificate_file:
self.certificate_file = join(install_dir, 'qiita_core',
'support_files', 'server.crt')
'support_files', 'ci_server.crt')

self.cookie_secret = config.get('main', 'COOKIE_SECRET')
if not self.cookie_secret:
Expand All @@ -232,7 +232,7 @@ def _get_main(self, config):
self.key_file = config.get('main', 'KEY_FILE')
if not self.key_file:
self.key_file = join(install_dir, 'qiita_core', 'support_files',
'server.key')
'ci_server.key')

def _get_job_scheduler(self, config):
"""Get the configuration of the job_scheduler section"""
Expand Down
4 changes: 2 additions & 2 deletions qiita_core/tests/test_configuration_manager.py
Original file line number Diff line number Diff line change
Expand Up @@ -150,10 +150,10 @@ def test_get_main(self):
# Default certificate_file
self.assertTrue(
obs.certificate_file.endswith(
"/qiita_core/support_files/server.crt"))
"/qiita_core/support_files/ci_server.crt"))
# Default key_file
self.assertTrue(
obs.key_file.endswith("/qiita_core/support_files/server.key"))
obs.key_file.endswith("/qiita_core/support_files/ci_server.key"))

# BASE_DATA_DIR does not exist
conf_setter('BASE_DATA_DIR', '/surprised/if/this/dir/exists')
Expand Down
4 changes: 2 additions & 2 deletions qiita_pet/nginx_example.conf
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ http {
merge_slashes off;
ssl on;

ssl_certificate /home/runner/work/qiita/qiita/qiita_core/support_files/server.crt;
ssl_certificate_key /home/runner/work/qiita/qiita/qiita_core/support_files/server.key;
ssl_certificate /home/runner/work/qiita/qiita/qiita_core/support_files/ci_server.crt;
ssl_certificate_key /home/runner/work/qiita/qiita/qiita_core/support_files/ci_server.key;

ssl_session_timeout 5m;

Expand Down
6 changes: 3 additions & 3 deletions setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,9 @@
package_data={
'qiita_core': [
'support_files/config_test.cfg'
'support_files/server.crt',
'support_files/server.csr',
'support_files/server.key'
'support_files/ci_server.crt',
'support_files/ci_server.csr',
'support_files/ci_server.key'
],
'qiita_db': [
'support_files/*.sql',
Expand Down

0 comments on commit a9e5e6f

Please sign in to comment.