Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Develop - FixLetEncryptCertChain-import #3

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Conversation

joeri-juramento
Copy link

For your review. 😄

The main strategy is importing a certficate chain once with keytool and therefore not needing any other individual certificate inside the key store.

Take note that the root certificate is also replaced by the ISRG Root X1 certifcate of LetsEncrypt. Since it is the root cert, it is self-signed.

Obviously you may want to need to work your magic to implement a solution that is not hardcoded.
Though before you dive into that, maybe it is worth to ponder if we truly want to terminate ssl at this machine, or maybe place Cloudflare in between and have private SSL relation between cloudflare and the server. Penny for your thoughts on that one.

In this solution the server provides visting clients with a certificate chain and not "a leaf", or an individual cert. Therefore clients to do not have to rebuild the chain themselves blindly, preventing them from taking "a wrong turn" when different chains exist. (I do wonder, why clients dont try the other chain when one fails.)

Correct me if I'm wrong. Feedback is welcome.

//JJ tags just so you can easily see what I touched when inside the file. Obviously you can remove them after you have validated the changes will do no unintentional harm.

…hain).

This was originally start and stop step. Keep in mind we're updating a live certificate store, so it's possibly to go back to stop-start if needed in the future.
Steps can be reverted individually if required in seperate commits in feature branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant