acme service: generate a CA for self-signed certificate #38372

abbradar · 2018-04-03T09:28:37Z

Motivation for this change

This is needed because simp_le expects two certificates in fullchain.pem, leading to error:

Not enough PEM encoded messages were found in fullchain.pem; at least 2 were expected, found 1.

We now create a CA and sign the key with it instead, providing correct fullchain.pem.

Things done

Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- other Linux distributions
Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

cc @vcunat @fpletz -- this is a potentially serious release issue. security.acme with fullchain.pem (e.g. nginx's enableACME) doesn't work at all on new servers now.

Tested on a fresh server with clean /var/lib/acme using nginx's enableACME.

This is needed because simp_le expects two certificates in fullchain.pem, leading to error: > Not enough PEM encoded messages were found in fullchain.pem; at least 2 were expected, found 1. We now create a CA and sign the key with it instead, providing correct fullchain.pem. Also cleanup service a bit -- use PATH and a private temporary directory (which is more suitable).

dotlambda · 2018-04-05T12:05:29Z

@GrahamcOfBorg test acme

GrahamcOfBorg · 2018-04-05T12:06:06Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.acme

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-04-05T12:11:27Z

Failure on x86_64-linux (full log)

Attempted: tests.acme

Partial log (click to expand)

building path(s) ‘/nix/store/9wylh3h3jawwkh8fl9n86ps6bhhary25-etc’
building path(s) ‘/nix/store/36b6xnw5czdv4ii7bvrrd8lhqp6446mq-nixos-system-letsencrypt-18.09.git.129dfe8’
building path(s) ‘/nix/store/vp5qns0wxbd7fhxzndicn9rbhzmx34pa-closure-info’
/nix/store/aj9rz4k3xvg8q9fzqfnb0q123707zp0n-builder: line 1: .attrs.sh: No such file or directory
builder for ‘/nix/store/i0dangqfm60204nq2nigf232j88myyy4-closure-info.drv’ failed with exit code 1
cannot build derivation ‘/nix/store/7mcxgd7gck3mannmg4gsj4bh38vvcd23-run-nixos-vm.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/pkg019k28f56lv87z06vr97x65y4n7b0-nixos-vm.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/xm0nap8dcsqz0fvdnym0xpm3x11ndacn-nixos-test-driver-acme.drv’: 3 dependencies couldn't be built
cannot build derivation ‘/nix/store/wfs01vg45plkvwhh1lxfia7h9xf2wp4c-vm-test-run-acme.drv’: 1 dependencies couldn't be built
error: build of ‘/nix/store/wfs01vg45plkvwhh1lxfia7h9xf2wp4c-vm-test-run-acme.drv’ failed

abbradar · 2018-04-05T12:17:47Z

Didn't know we have a test for ACME. I'll check it out, thanks (issue looks unrelated now).

dotlambda · 2018-04-05T12:35:46Z

The test works for me locally. Let's try again.

@GrahamcOfBorg eval
@GrahamcOfBorg test acme

GrahamcOfBorg · 2018-04-05T12:36:21Z

Failure on x86_64-linux (full log)

Attempted: tests.acme

Partial log (click to expand)

cannot build derivation ‘/nix/store/sl23xd70b2bgwdbsbzypmsqxs6vr7fvg-nixos-vm.drv’: 1 dependencies couldn't be built
building path(s) ‘/nix/store/fh86kc2fz32cjp482mckmzhq0fjjx9di-nixos-system-letsencrypt-18.09.git.87dbf56’
building path(s) ‘/nix/store/a0mlbbkvlvpba3q73yyjc9qlrpir91ch-closure-info’
/nix/store/aj9rz4k3xvg8q9fzqfnb0q123707zp0n-builder: line 1: .attrs.sh: No such file or directory
builder for ‘/nix/store/5v9x1rpshqlajvcig22fgj6x8nlld6l2-closure-info.drv’ failed with exit code 1
cannot build derivation ‘/nix/store/205vfldd1xx0kyhn8n95ws761cmy6m0l-run-nixos-vm.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/wkkkrbq2f40x0926n0xfnxgcp03mbdr1-nixos-vm.drv’: 1 dependencies couldn't be built
cannot build derivation ‘/nix/store/6fy0hiwfgzf23dfg7bxdpqzbgjsc8yaw-nixos-test-driver-acme.drv’: 3 dependencies couldn't be built
cannot build derivation ‘/nix/store/6y0c5fck47rqwm1ra41ldzazmf5kgvsg-vm-test-run-acme.drv’: 1 dependencies couldn't be built
error: build of ‘/nix/store/6y0c5fck47rqwm1ra41ldzazmf5kgvsg-vm-test-run-acme.drv’ failed

GrahamcOfBorg · 2018-04-05T12:36:26Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.acme

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowBroken = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowBroken = true; }
to ~/.config/nixpkgs/config.nix.

wmertens · 2018-04-11T04:49:09Z

The test error seems to be

/nix/store/aj9rz4k3xvg8q9fzqfnb0q123707zp0n-builder: line 1: .attrs.sh: No such file or directory

...which seems unrelated.

The changes look good to me.

abbradar · 2018-04-11T15:10:19Z

Merging this in several days unless there's an issue.

dotlambda · 2018-04-11T15:13:26Z

Shouldn't this be fixed upstream or is there reason to expect two certificates?
Maybe we can just patch the check out rather than adapting the module?

abbradar · 2018-04-11T15:15:39Z

@dotlambda I don't think this is an upstream issue -- they expect their own generated files to be there after all. We can patch the check but I liked the approach of making our self-signed certificates closer to the actual ones more -- no hard opinion here though.

wmertens · 2018-04-11T15:34:22Z

So, why can't we just let simp_le do the certificate creation? Perhaps the upstream issue should be that we can't use their stuff because of $reason?

…

On Wed, Apr 11, 2018 at 5:15 PM Nikolay Amiantov ***@***.***> wrote: @dotlambda <https://github.com/dotlambda> I don't think this is an upstream issue -- they expect their own generated files to be there after all. We can patch the check but I liked the approach of making our self-signed certificates closer to the actual ones more -- no hard opinion here though. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#38372 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADWlnEgPFQz0KSAAytPrvcfNW0KyhCvks5tnh4cgaJpZM4TEvPF> .

abbradar · 2018-04-11T15:35:43Z

@wmertens The point is to make some test certificates so that nginx can start (it fails otherwise without a cert at all) and simp_le can then replace them with proper certs.

wmertens · 2018-04-11T15:43:42Z

Aha ok. Still, seems like it could be an upstream feature "please make some temp certs where you will be writing the real ones"

…

On Wed, Apr 11, 2018 at 5:35 PM Nikolay Amiantov ***@***.***> wrote: @wmertens <https://github.com/wmertens> The point is to make *some* test certificates so that nginx can start (it fails otherwise without a cert at all) and simp_le can then replace them with proper certs. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#38372 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AADWlkalx0GE48J36ZCKjrNr0ybRSangks5tniLSgaJpZM4TEvPF> .

abbradar · 2018-04-11T15:49:43Z

@wmertens Filed zenhack/simp_le#105

abbradar added 0.kind: bug 6.topic: nixos labels Apr 3, 2018

abbradar added this to the 18.03 milestone Apr 3, 2018

GrahamcOfBorg added the 8.has: module (update) label Apr 3, 2018

abbradar force-pushed the acme-fix branch from ce2ccd0 to 63c7abe Compare April 3, 2018 09:43

GrahamcOfBorg added 10.rebuild-darwin: 0 10.rebuild-linux: 0 labels Apr 3, 2018

dotlambda mentioned this pull request Apr 3, 2018

Using certificateScheme = 3 fails r-raymond/nixos-mailserver#111

Open

wmertens approved these changes Apr 11, 2018

View reviewed changes

abbradar merged commit 4fc0b4e into NixOS:master Apr 17, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

acme service: generate a CA for self-signed certificate #38372

acme service: generate a CA for self-signed certificate #38372

abbradar commented Apr 3, 2018

dotlambda commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

abbradar commented Apr 5, 2018

dotlambda commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

wmertens commented Apr 11, 2018

abbradar commented Apr 11, 2018

dotlambda commented Apr 11, 2018

abbradar commented Apr 11, 2018

wmertens commented Apr 11, 2018 via email

abbradar commented Apr 11, 2018

wmertens commented Apr 11, 2018 via email

abbradar commented Apr 11, 2018

acme service: generate a CA for self-signed certificate #38372

acme service: generate a CA for self-signed certificate #38372

Conversation

abbradar commented Apr 3, 2018

Motivation for this change

Things done

dotlambda commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

abbradar commented Apr 5, 2018

dotlambda commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

GrahamcOfBorg commented Apr 5, 2018

wmertens commented Apr 11, 2018

abbradar commented Apr 11, 2018

dotlambda commented Apr 11, 2018

abbradar commented Apr 11, 2018

wmertens commented Apr 11, 2018 via email

abbradar commented Apr 11, 2018

wmertens commented Apr 11, 2018 via email

abbradar commented Apr 11, 2018