letsencrypt
/
boulder
mirror of https://github.com/letsencrypt/boulder.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

set permissions for generated certs and keys (#7193) 

minica by default sets restrictive permissions on the directories it
makes. This produced confusing behavior after regenerating keys: the
`bconsul` container failed to start up because it couldn't access its
TLS keys, which led to other errors during startservers.
This commit is contained in:
Jacob Hoffman-Andrews 2023-12-07 20:03:35 -08:00 committed by GitHub
parent cb5384dcd7
commit a0ce126a0f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
test/grpc-creds/generate.sh
View File

@ -2,6 +2,8 @@
set -e
set -o xtrace
cd "$(realpath -- $(dirname -- "$0"))"
# Check that `minica` is installed
command -v minica >/dev/null 2>&1 || {
echo >&2 "No 'minica' command available.";
@ -18,3 +20,6 @@ done
for SERVICE in publisher nonce ra ca sa va rva ; do
minica -domains "${SERVICE}.boulder,${SERVICE}1.boulder,${SERVICE}2.boulder"
done
# minica sets restrictive directory permissions, but we don't want that
chmod -R go+rX .

5
test/redis-tls/generate.sh
View File

@ -2,6 +2,8 @@
set -e
set -o xtrace
cd "$(realpath -- $(dirname -- "$0"))"
# Check that `minica` is installed
command -v minica >/dev/null 2>&1 || {
echo >&2 "No 'minica' command available.";
@ -12,3 +14,6 @@ command -v minica >/dev/null 2>&1 || {
minica -domains boulder
minica -domains boulder-redis
minica -domains redis -ip-addresses 10.33.33.2,10.33.33.3,10.33.33.4,10.33.33.5,10.33.33.6,10.33.33.7,10.33.33.8,10.33.33.9
# minica sets restrictive directory permissions, but we don't want that
chmod -R go+rX .