Comments (8)
Sorted via IRC, the issue came down to using pki_realms:
instead of pki_group_realms
. Thank you drybjed!
from ansible-pki.
To disable the internal certificates, you need to set the pki_internal: False
variable for a given host. With this, Ansible won't generate certificate requests for the internal CA, and they won't be signed.
Are your external certs/private key copied to the hosts in the test
inventory group? You should see a test
PKI realm on these hosts.
from ansible-pki.
Setting pki_internal: False
on the host disables internal cert signing. I then end up with a selfsigned one. Is this really per host? If the whole realm is external, shouldn't that disable internal/acme/selfsigned for that realm? I believe I'm missing something here.
How would you go about mixed environments? My final setup would include multiple internal and external realms. Hosts would be in one or multiple inventory groups belonging to those realms.
The external certs/private key aren't copied. They are not on the host in the test
inventory group.
from ansible-pki.
First of all, each PKI realm supports separate set of external/acme/internal/selfsigned certificates, in that order, all using the same private key. The pki-realm
script detects if external certificates are available, and enables them if they are; otherwise selfsigned will be used. This because services usually expect some kind of X.509 certs/keys available, otherwise they won't start. Even if you have internal CA enabled, if you provide external certificates/private key, they should take precedence.
Now, for the external certificates and private keys, they work slightly differently depending on the inventory level (all, group, host). First, host-based files are copied to the remote hosts. After that, group and all files are copied, only if there are no files already in place - this is so that you can provide for example external certificates for all hosts, but also add a different set for a specific host - this way that specific set will take precedence and won't be overriden.
In your case, you are using a group level certificates/private keys. If you tried to enable it after the PKI realm was created, there might be a cert/private key mismatch. Remove the PKI realm directory on the remote host and try running debops.pki
again. Afterwards, show the output of tree /etc/pki/realms/
here, let's see what you get.
from ansible-pki.
I've been removing the pki directory on the remote host between every try already. This is what I end up with after a clean run:
tree pki/
pki/
├── hooks
└── realms
└── test
├── acme
│ ├── account_key.pem
│ ├── openssl.conf
│ └── request.pem
├── CA.crt -> public/root.pem
├── config
│ └── realm.conf
├── default.crt -> public/cert.pem
├── default.key -> private/key.pem
├── default.pem -> private/key_chain.pem
├── external
├── internal
├── private
│ ├── key_chain.pem
│ ├── key.pem
│ └── realm_key.pem
├── public
│ ├── cert.pem -> ../selfsigned/cert.pem
│ ├── cert.pem.sig
│ └── root.pem -> ../selfsigned/root.pem
├── selfsigned
│ ├── cert.pem
│ ├── gnutls.conf
│ ├── request.pem
│ └── root.pem -> cert.pem
└── trusted.crt -> public/root.pem
10 directories, 19 files
from ansible-pki.
Hmm, weird... Could you show the debops.pki
run as well? I'm interested in Download private realm contents *
and Download external realm contents *
tasks.
from ansible-pki.
TASK [debops.pki : Download private realm contents by host] ********************
ok: [hostname] => (item={u'name': u'test'})
TASK [debops.pki : Download private realm contents by group] *******************
TASK [debops.pki : Download private realm contents for all hosts] **************
ok: [hostname] => (item={u'name': u'test'})
TASK [debops.pki : Download external realm contents by group] ******************
TASK [debops.pki : Download external realm contents for all hosts] *************
ok: [hostname] => (item={u'name': u'test'})
from ansible-pki.
Is that host included in the [test]
Ansible inventory group? Otherwise I'm not really sure what's happening. I suppose that we could maybe do a TeamViewer session so I could see what are you trying to do, any chance for that? Can you come over to IRC so we could talk more real-time?
from ansible-pki.
Related Issues (20)
- Role breaks without warning (and continues on "normally") if SAN misconfigured HOT 9
- Fail: No module named debops HOT 12
- [Security] debops.pki does not validate CSRs allowing certificate mis-issuance by compromised remote host
- tiny-acme suddenly causes errors HOT 20
- First PKI run fails to create ACME certificates HOT 4
- Changing config parameters has not effect HOT 2
- Changing pki_acme_ca does not reload the nginx server
- Improve docs visibility of `name_constraints` variable
- Remove the pain points when managing ACME certificates HOT 12
- Replaced external certificates are not copied to host HOT 1
- Failure on task: Sign certificate requests for current hosts HOT 3
- ./lib/pki-authority: line 164: declare: -g: invalid option error HOT 3
- debops.pki fails when 1 of the hosts is unreachable HOT 1
- Errors during creation of new LetsEncrypt account via acme. HOT 6
- Error every second pki run HOT 9
- KeyError: 'newAccount' when attempting to generate ACME certificate HOT 5
- Role debops.pki/env fails to resolve after Ansible 2.4 HOT 10
- No wildcard/domain in the 'domain' realm certificates HOT 2
- pki role generates invalid certificate with "permitted subtree violation"
- ing
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ansible-pki.