Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-7928

Use "Let's encrypt" for OFBiz demos SSL/TLS certificates

    Details

      Description

      This is a transtion from INFRA-11960

      After some tries, I have finally decided to adapt and use http://blog.ivantichy.cz/blogpost/view/74 which is the most convenient way for OFBiz

      Since we need to use SANs (for demo-trunk-ofbiz.apache.org, demo-stable-ofbiz.apache.org and demo-old-ofbiz.apache.org which are actually OFBiz instances using different set of ports), I will try to use "-d ofbiz-vm.apache.org" as 1st "-d" argument and if that does not work I'll simply use the "-d" parameter with the other sub-domains only. What I actually need is a renewable certificate in the OFBiz Java keystore (ofbiz.jks) with the SANs present. From my experiences, the (adapted) script above should provide me that.

      Maybe another possibility would be to install our own HTTPS and use the instructions provided by Sam Ruby in INFRA-11960. I have to balance the work with adapting the script I refered to above.

      The EFF has published new instructions: https://certbot.eff.org/#ubuntutrusty-apache

      FWIW, I had no problem moving from whimy-vm2 to whimsy-vm3. I've now got certs for a second machine (ghmon-vm). Here's the puppet instructions to download certbot, create a cronjob, and add use the certificates with Apache httpd:

      https://github.com/apache/infrastructure-puppet/pull/107/commits/8fea8223f398a77e67173c1b0c1b06b80fe576b0

      Once this is deployed, all that is left is running a single command: certbot-auto -d host1.apache.org -d host2.apache.org... and answering two prompts (you need to provide an email address and to indicate that you have read the terms of service).

        Issue Links

          Activity

          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          I'm now quite sure it was only an OFBiz internal issue ans not related with INFRA-11960 and its resolution

          Show
          jacques.le.roux Jacques Le Roux added a comment - I'm now quite sure it was only an OFBiz internal issue ans not related with INFRA-11960 and its resolution
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          Thanks to Leonard Lin we have now OFBIZ-9224

          Show
          jacques.le.roux Jacques Le Roux added a comment - Thanks to Leonard Lin we have now OFBIZ-9224
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          I'll create one when I'll be sure it's due to an OFBiz internal feature.

          Show
          jacques.le.roux Jacques Le Roux added a comment - I'll create one when I'll be sure it's due to an OFBiz internal feature.
          Hide
          pfm.smits Pierre Smits added a comment -

          Yes, that would warrant a new issue.

          Show
          pfm.smits Pierre Smits added a comment - Yes, that would warrant a new issue.
          Hide
          jacques.le.roux Jacques Le Roux added a comment - - edited

          It seems we have another issue indeed: systematically the port 8443 is added to URLs.
          I prefer to keep it open as long as we have not clearly diagnosticated the origin of the issue. I'll work on this as soon as I'll get a chance...

          Show
          jacques.le.roux Jacques Le Roux added a comment - - edited It seems we have another issue indeed: systematically the port 8443 is added to URLs. I prefer to keep it open as long as we have not clearly diagnosticated the origin of the issue. I'll work on this as soon as I'll get a chance...
          Hide
          pfm.smits Pierre Smits added a comment -

          I am inclined to close this issue as the initial intent has been resolved.

          Show
          pfm.smits Pierre Smits added a comment - I am inclined to close this issue as the initial intent has been resolved.
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          I reopen this still does not work. I plan to have a look, not sure when yet...

          Show
          jacques.le.roux Jacques Le Roux added a comment - I reopen this still does not work. I plan to have a look, not sure when yet...
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          This is now done, thanks to Pierre and infra see INFRA-11960

          I'll create a task to maintain the documentation in ofbiz\tools\demo-backup\README.MD which is then used to generate https://cwiki.apache.org/confluence/display/OFBIZ/The+official+demos+and+how+to+maintain+them

          Show
          jacques.le.roux Jacques Le Roux added a comment - This is now done, thanks to Pierre and infra see INFRA-11960 I'll create a task to maintain the documentation in ofbiz\tools\demo-backup\README.MD which is then used to generate https://cwiki.apache.org/confluence/display/OFBIZ/The+official+demos+and+how+to+maintain+them
          Hide
          pfm.smits Pierre Smits added a comment -

          Has been reopened. Pull request regarding configuration of the vm submitted. See https://github.com/apache/infrastructure-puppet/pull/163

          Show
          pfm.smits Pierre Smits added a comment - Has been reopened. Pull request regarding configuration of the vm submitted. See https://github.com/apache/infrastructure-puppet/pull/163
          Hide
          pfm.smits Pierre Smits added a comment -

          I will have the INFRA-11960 reopened.

          Show
          pfm.smits Pierre Smits added a comment - I will have the INFRA-11960 reopened.
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          Feel free to work on it Pierre.

          Show
          jacques.le.roux Jacques Le Roux added a comment - Feel free to work on it Pierre.
          Hide
          pfm.smits Pierre Smits added a comment -

          Hi Jacques Le Roux,

          I would like to reassign this issue to myself to get this successfully resolved. Any objections?

          Show
          pfm.smits Pierre Smits added a comment - Hi Jacques Le Roux , I would like to reassign this issue to myself to get this successfully resolved. Any objections?
          Hide
          pfm.smits Pierre Smits added a comment -

          The associated task in INFRA.

          Show
          pfm.smits Pierre Smits added a comment - The associated task in INFRA.
          Hide
          jacques.le.roux Jacques Le Roux added a comment -

          Since I wrote this I changed my mind and finally decided to rather install an HTTPD instance and use Sam's way.

          Show
          jacques.le.roux Jacques Le Roux added a comment - Since I wrote this I changed my mind and finally decided to rather install an HTTPD instance and use Sam's way.

            People

            • Assignee:
              pfm.smits Pierre Smits
              Reporter:
              jacques.le.roux Jacques Le Roux
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development