TLS on Logan's Nest

Generate custom x509 certificate in Okta

Sun, 19 Nov 2017 00:00:00 +0000

* Requires API key with admin access, least for the target app

Obtain app name & label using app ID

1
2
3
4
5


curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: SSWS ${api_token}" \
"https://[okta_instance].okta.com/api/v1/apps/[app_id]"

Generate custom certificate and capture ‘kid’ value from response

Lets Encrypt nginx SSL certificate renewal via cron

Wed, 18 Nov 2015 00:00:00 +0000

Add below as a cron entry.

1
2
3


#!/bin/bash
/path/letsencrypt/letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory --renew-by-default -a webroot --webroot-path /webroot/ --email youremail --text --agree-tos --agree-dev-preview -d 7979.us -d www.7979.us auth
/etc/init.d/nginx reload

Then configure nginx SSL like below.

Foreman + Puppet autosign.conf doesn't work

Mon, 08 Sep 2014 00:00:00 +0000

Issue: 1. Foreman generates auto sign entry when /provision called first time. (boot loader hit) 2. Once OS is done and call puppet agent run, CSR doesn’t get auto-signed. - stays in ‘pending’ status forever

Generate Bacula client cert/key pair via Puppet

Wed, 28 May 2014 00:00:00 +0000

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


exec {'generate client key file':
command => '/usr/bin/openssl genrsa -out /bacula/bacula-client.key 2048;chmod 600 /bacula/bacula-client.key',
creates => '/bacula/bacula-client.key',
require => Package['bacula-fd'],
}

exec {'generate client cert file':
command => '/usr/bin/openssl req -new -key /bacula/bacula-client.key -x509 -subj "/C=AU/ST=somewhere/L=somewhere/O=something/CN=something" -out /bacula/bacula-client.cert',
creates => '/bacula/bacula-client.cert',
require => [ Package['bacula-fd'], Exec['generate client key file'], ],
}

exec {'combine client key and cert files':
notify => Service["bacula-fd"],
command => '/bin/cat /bacula/bacula-client.key /bacula/bacula-client.cert > /bacula/bacula-client.pem;chmod 600 /bacula/bacula-client.pem',
creates => '/bacula/bacula-client.pem',
require => [ Package['bacula-fd'], Exec['generate client key file'], Exec['generate client cert file'], ],
}

Would be nicer if I can send them to backup location but doesn’t really matter as there’s master key.