Skip to content

Commit 3cb7df6

Browse files
buchdagbuchdag
authored
feat: disable default certificate creation by default (#1157)
1 parent 904b5e3 commit 3cb7df6

File tree

12 files changed

+15
-140
lines changed

12 files changed

+15
-140
lines changed

‎app/cleanup_test_artifacts

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,6 @@ while [[ $# -gt 0 ]]; do
77
flag="$1"
88

99
case $flag in
10-
--default-cert)
11-
for filename in default.crt default.key; do
12-
filepath="/etc/nginx/certs/$filename"
13-
[[ -f "$filepath" ]] && rm -rf "$filepath"
14-
done
15-
shift
16-
;;
17-
1810
--location-config)
1911
for domain in 'le1.wtf' '*.example.com' 'test.*' 'le3.pizza' 'subdomain.example.com' 'test.domain.tld'; do
2012
[[ -f "/etc/nginx/vhost.d/$domain" ]] && rm -f "/etc/nginx/vhost.d/$domain"

‎app/entrypoint.sh

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,9 @@ function check_dh_group {
110110
}
111111

112112
function check_default_cert_key {
113-
local cn='letsencrypt-nginx-proxy-companion'
113+
local cn='acme-companion'
114+
115+
echo "Warning: there is no future support planned for the self signed default certificate creation feature and it might be removed in a future release."
114116

115117
if [[ -e /etc/nginx/certs/default.crt && -e /etc/nginx/certs/default.key ]]; then
116118
default_cert_cn="$(openssl x509 -noout -subject -in /etc/nginx/certs/default.crt)"
@@ -179,7 +181,7 @@ if [[ "$*" == "/bin/bash /app/start.sh" ]]; then
179181
check_writable_directory '/etc/nginx/vhost.d'
180182
check_writable_directory '/etc/nginx/conf.d'
181183
fi
182-
check_default_cert_key
184+
parse_true "${CREATE_DEFAULT_CERTIFICATE:=false}" && check_default_cert_key
183185
check_dh_group
184186
reload_nginx
185187
check_default_account

‎docs/Let's-Encrypt-and-ACME.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,3 +153,7 @@ Reusing private keys can help if you intend to use [HPKP](https://developer.mozi
153153
1. The container will use the special purpose `staging` configuration directory.
154154
1. The directory URI is forced to The Let's Encrypt v2 staging one (`ACME_CA_URI` is ignored)
155155
2. The account email address is forced empty (`DEFAULT_EMAIL` and `LETSENCRYPT_EMAIL` are ignored)
156+
157+
#### Self signed default certificate
158+
159+
If you want **acme-companio** to create a self signed certificate as default certificate for **nginx-proxy**, you can set the `CREATE_DEFAULT_CERTIFICATE` environment variable to `true`. This will generate a self signed cert / key pair to `/etc/nginx/certs/default.crt` and `/etc/nginx/certs/default.key`, with `acme-companion` as Common Name. Please note that no future support is planned for this feature and it might be removed in a future release.

‎docs/Persistent-data.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,6 @@ By default, the **acme-companion** container will enforce the following ownershi
6565
```
6666
[drwxr-xr-x] /etc/nginx/certs
6767
├── [-rw-r--r-- root root] dhparam.pem
68-
├── [-rw-r--r-- root root] default.crt
69-
├── [-rw------- root root] default.key
7068
├── [drwxr-xr-x root root] domain.tld
7169
│ ├── [-rw-r--r-- root root] cert.pem
7270
│ ├── [-rw-r--r-- root root] chain.pem
@@ -90,8 +88,6 @@ For example, `FILES_UID=1000`, `FILES_PERMS=644` and `FOLDERS_PERMS=700` will re
9088
```
9189
[drwxr-xr-x] /etc/nginx/certs
9290
├── [-rw-r--r-- 1000 1000] dhparam.pem
93-
├── [-rw-r--r-- 1000 1000] default.crt
94-
├── [-rw-r--r-- 1000 1000] default.key
9591
├── [drwx------ 1000 1000] domain.tld
9692
│ ├── [-rw-r--r-- 1000 1000] cert.pem
9793
│ ├── [-rw-r--r-- 1000 1000] chain.pem

‎test/config.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ globalTests+=(
55
docker_api
66
docker_api_legacy
77
location_config
8-
default_cert
98
certs_single
109
certs_san
1110
certs_single_domain

‎test/tests/certs_single_domain/run.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,6 @@ for hosts in "${letsencrypt_hosts[@]}"; do
9696
done
9797

9898
docker stop "$container" &> /dev/null
99-
docker exec "$le_container_name" /app/cleanup_test_artifacts --default-cert
10099
i=$(( i + 1 ))
101100

102101
done

‎test/tests/default_cert/expected-std-out.txt

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎test/tests/default_cert/run.sh

Lines changed: 0 additions & 105 deletions
This file was deleted.

‎test/tests/permissions_custom/run.sh

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,8 @@ done
6666

6767
# Array of private file paths to test
6868
private_files=( \
69-
[0]="/etc/nginx/certs/default.key" \
70-
[1]="/etc/nginx/certs/${domains[0]}/key.pem" \
71-
[2]="/etc/acme.sh/default/${domains[0]}/${domains[0]}.key" \
69+
[0]="/etc/nginx/certs/${domains[0]}/key.pem" \
70+
[1]="/etc/acme.sh/default/${domains[0]}/${domains[0]}.key" \
7271
)
7372

7473
# Test private file paths
@@ -85,8 +84,7 @@ public_files=( \
8584
[1]="/etc/nginx/certs/${domains[0]}/cert.pem" \
8685
[2]="/etc/nginx/certs/${domains[0]}/chain.pem" \
8786
[3]="/etc/nginx/certs/${domains[0]}/fullchain.pem" \
88-
[4]="/etc/nginx/certs/default.crt" \
89-
[5]="/etc/nginx/certs/dhparam.pem" \
87+
[4]="/etc/nginx/certs/dhparam.pem" \
9088
)
9189

9290
# Test public file paths

‎test/tests/permissions_default/run.sh

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,8 @@ done
6060

6161
# Array of private file paths to test
6262
private_files=( \
63-
[0]="/etc/nginx/certs/default.key" \
64-
[1]="/etc/nginx/certs/${domains[0]}/key.pem" \
65-
[2]="/etc/acme.sh/default/${domains[0]}/${domains[0]}.key" \
63+
[0]="/etc/nginx/certs/${domains[0]}/key.pem" \
64+
[1]="/etc/acme.sh/default/${domains[0]}/${domains[0]}.key" \
6665
)
6766

6867
# Test private file paths
@@ -79,8 +78,7 @@ public_files=( \
7978
[1]="/etc/nginx/certs/${domains[0]}/cert.pem" \
8079
[2]="/etc/nginx/certs/${domains[0]}/chain.pem" \
8180
[3]="/etc/nginx/certs/${domains[0]}/fullchain.pem" \
82-
[4]="/etc/nginx/certs/default.crt" \
83-
[5]="/etc/nginx/certs/dhparam.pem" \
81+
[4]="/etc/nginx/certs/dhparam.pem" \
8482
)
8583

8684
# Test public file paths

‎test/tests/symlinks/run.sh

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,7 @@ docker exec "$le_container_name" cp /etc/nginx/certs/le1.wtf/key.pem /etc/nginx/
4747
docker exec "$le_container_name" bash -c 'cd /etc/nginx/certs; ln -s ./le4.wtf/fullchain.pem ./le4.wtf.crt'
4848
docker exec "$le_container_name" bash -c 'cd /etc/nginx/certs; ln -s ./le4.wtf/key.pem ./le4.wtf.key'
4949

50-
# symlink default certificate to le1.wtf certificate
51-
docker exec "$le_container_name" rm -f /etc/nginx/certs/default.crt /etc/nginx/certs/default.key
50+
# Symlink default certificate to le1.wtf certificate
5251
docker exec "$le_container_name" bash -c 'cd /etc/nginx/certs; ln -s ./le1.wtf/fullchain.pem ./default.crt'
5352
docker exec "$le_container_name" bash -c 'cd /etc/nginx/certs; ln -s ./le1.wtf/key.pem ./default.key'
5453

‎test/tests/test-functions.sh

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,6 @@ export -f check_cert_subj
263263

264264
# Wait for a successful https connection to domain passed with -d/--domain then wait
265265
# - until the served certificate isn't the default one (default behavior)
266-
# - until the served certificate is the default one (--default-cert)
267266
# - until the served certificate subject match a string (--subject-match)
268267
function wait_for_conn {
269268
local action
@@ -280,11 +279,6 @@ function wait_for_conn {
280279
shift
281280
;;
282281

283-
--default-cert)
284-
action='--match'
285-
shift
286-
;;
287-
288282
--subject-match)
289283
action='--match'
290284
string="$2"

0 commit comments

Comments
 (0)