SSL - Revision history

O32patel: add ranch ssl

2026-01-22T03:45:07Z

add ranch ssl

← Older revision		Revision as of 22:45, 21 January 2026
Line 139:		Line 139:
	* auth1:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)		* auth1:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
	* auth2:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)		* auth2:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
	* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt ~~(for ceod)~~		* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt
			* ranch:/etc/ssl/private/csclub-wildcard-chain.crt (for ceod)
	* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)		* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)
	* caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)		* caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)

S23adhik at 00:35, 9 December 2025

2025-12-09T00:35:15Z

← Older revision		Revision as of 19:35, 8 December 2025
Line 149:		Line 149:
	* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
			* keycloak: /opt/keycloak/ssl (you can figure out the rest)
	* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)		* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)
	* <s>bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)</s> (Also certbot)		* <s>bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)</s> (Also certbot)

O32patel: Cert location list update

2025-11-11T17:00:56Z

Cert location list update

← Older revision		Revision as of 12:00, 11 November 2025
Line 137:		Line 137:
	A list of places you'll need to put the new certificate to keep our services running. Private key (if applicable) should be kept next to the certificate with the extension .key.		A list of places you'll need to put the new certificate to keep our services running. Private key (if applicable) should be kept next to the certificate with the extension .key.

	* ~~caffeine~~:/etc/ssl/private/csclub-wildcard.crt (for ~~Apache~~)		* auth1:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
		⚫	* auth2:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
		⚫	* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt (for ceod)
	* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)		* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)
	* ~~<s>mail~~:/etc/ssl/private/csclub-wildcard.crt (for Apache~~, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these~~)		* caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)
	* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)		* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
		⚫	* prometheus:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
	* potassium-benzoate:/etc/ssl/private/csclub-wildcard.crt (for nginx)		* potassium-benzoate:/etc/ssl/private/csclub-wildcard.crt (for nginx)
⚫	* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt (for ceod)
	* auth1:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
⚫	* auth2:/etc/ssl/private/csclub-wildcard.crt (for slapd, make sure to <code>sudo service slapd restart</code>)
	* mattermost:/etc/ssl/private/csclub-wildcard.crt (for nginx)		* mattermost:/etc/ssl/private/csclub-wildcard.crt (for nginx)
⚫	* load-balancer-0(1\|2):/etc/ssl/private/csclub.uwaterloo.ca (for haproxy) [~~temporarily~~ ~~down~~ 2020]
	* chat:/etc/ssl/private/csclub-wildcard-chain.crt (for nginx)		* chat:/etc/ssl/private/csclub-wildcard-chain.crt (for nginx)
⚫	* prometheus:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
⚫	* bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)
	* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
		⚫	* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)
		⚫	* <s>bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)</s> (Also certbot)
		⚫	* <s>load-balancer-0(1\|2):/etc/ssl/private/csclub.uwaterloo.ca (for haproxy)</s> [Down since 2020]

	Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.		Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.

O32patel: remove old cert locations (rip biloba and citric-acid)

2025-11-09T16:53:16Z

remove old cert locations (rip biloba and citric-acid)

← Older revision		Revision as of 11:53, 9 November 2025
Line 141:		Line 141:
	* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)		* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)
	* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)		* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
	* rt:/etc/ssl/private/csclub-wildcard.crt (for Apache)
	* potassium-benzoate:/etc/ssl/private/csclub-wildcard.crt (for nginx)		* potassium-benzoate:/etc/ssl/private/csclub-wildcard.crt (for nginx)
	* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt (for ceod)		* phosphoric-acid:/etc/ssl/private/csclub-wildcard-chain.crt (for ceod)
Line 151:		Line 150:
	* prometheus:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)		* prometheus:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
	* bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)		* bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (podman container on xylitol)
	* icy:/etc/ssl/private/csclub-wildcard.pem (for Icecast)
	* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* chamomile:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* biloba:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* citric-acid (runs vaultwarden): /etc/ssl/private/csclub.uwaterloo.ca.{chain,key} (for nginx)

	Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.		Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.

Merenber: /* GlobalSign */

2024-11-07T13:59:36Z

GlobalSign

← Older revision		Revision as of 08:59, 7 November 2024
Line 3:		Line 3:
	The CSC currently has an SSL Certificate from GlobalSign for *.csclub.uwaterloo.ca provided at no cost to us through IST. GlobalSign likes to take a long time to respond to certificate signing requests (CSR) for wildcard certs, so our CSR really needs to be handed off to IST at least 2 weeks in advance. You can do it sooner – the certificate expiry date will be the old expiry date + 1 year (+ a bonus ) Having an invalid cert for any length of time leads to terrible breakage, followed by terrible workarounds and prolonged problems.		The CSC currently has an SSL Certificate from GlobalSign for *.csclub.uwaterloo.ca provided at no cost to us through IST. GlobalSign likes to take a long time to respond to certificate signing requests (CSR) for wildcard certs, so our CSR really needs to be handed off to IST at least 2 weeks in advance. You can do it sooner – the certificate expiry date will be the old expiry date + 1 year (+ a bonus ) Having an invalid cert for any length of time leads to terrible breakage, followed by terrible workarounds and prolonged problems.

	When the certificate is due to expire in a month or two, syscom should (but apparently doesn't always) get an email notification. This will include a renewal link. Otherwise, use the [https://uwaterloo.ca/information-systems-technology/about/organizational-structure/information-security-services/certificate-authority/globalsign-signed-x5093-certificates/self-service-globalsign-ssl-certificates IST-CA self service system]. Please keep a copy of the key, CSR and (once issued) certificate in <tt>/~~home~~/sysadmin/certs</tt>. The OpenSSL examples linked there are good to generate a 2048-bit RSA key and a corresponding CSR. It's probably a good idea to change the private key (as it's not that much effort anyways). Just sure your CSR is for <tt>*.csclub.uwaterloo.ca</tt>.		When the certificate is due to expire in a month or two, syscom should (but apparently doesn't always) get an email notification. This will include a renewal link. Otherwise, use the [https://uwaterloo.ca/information-systems-technology/about/organizational-structure/information-security-services/certificate-authority/globalsign-signed-x5093-certificates/self-service-globalsign-ssl-certificates IST-CA self service system]. Please keep a copy of the key, CSR and (once issued) certificate in <tt>/users/sysadmin/certs</tt>. The OpenSSL examples linked there are good to generate a 2048-bit RSA key and a corresponding CSR. It's probably a good idea to change the private key (as it's not that much effort anyways). Just sure your CSR is for <tt>*.csclub.uwaterloo.ca</tt>.

	At the self-service portal, these options worked in 2013. If you need IST assistance, [mailto:ist-ca@uwaterloo.ca ist-ca@uwaterloo.ca] is the email address you should contact.		At the self-service portal, these options worked in 2013. If you need IST assistance, [mailto:ist-ca@uwaterloo.ca ist-ca@uwaterloo.ca] is the email address you should contact.

Merenber: /* How to add a new SSL cert for a custom domain on CSC cloud */

2024-09-11T13:01:13Z

How to add a new SSL cert for a custom domain on CSC cloud

← Older revision		Revision as of 08:01, 11 September 2024
Line 217:		Line 217:

	=== How to add a new SSL cert for a custom domain on CSC cloud ===		=== How to add a new SSL cert for a custom domain on CSC cloud ===
	Note: you do not need to acquire new cert if the requested domain is directly on csclub.cloud, e.g. app1.csclub.cloud. We can re-use our ~~wildcart~~ cert on csclub.cloud for that. However, if a user requests a multi-level domain on csclub.cloud, or a domain hosted on an external registrar, then you will need to create a new cert.		Note: you do not need to acquire a new cert if the requested domain is directly on csclub.cloud, e.g. app1.csclub.cloud. We can re-use our wildcard cert on csclub.cloud for that. However, if a user requests a multi-level domain on csclub.cloud, or a domain hosted on an external registrar, then you will need to create a new cert.

	Let's say user <code>ctdalek</code> wants <code>mydomain.com</code> to point to a VM on CSC cloud.		Let's say user <code>ctdalek</code> wants <code>mydomain.com</code> to point to a VM on CSC cloud.

Merenber: /* How to add a new SSL cert for a custom domain on CSC cloud */

2024-09-11T13:00:49Z

How to add a new SSL cert for a custom domain on CSC cloud

← Older revision		Revision as of 08:00, 11 September 2024
Line 217:		Line 217:

	=== How to add a new SSL cert for a custom domain on CSC cloud ===		=== How to add a new SSL cert for a custom domain on CSC cloud ===
			Note: you do not need to acquire new cert if the requested domain is directly on csclub.cloud, e.g. app1.csclub.cloud. We can re-use our wildcart cert on csclub.cloud for that. However, if a user requests a multi-level domain on csclub.cloud, or a domain hosted on an external registrar, then you will need to create a new cert.

	Let's say user <code>ctdalek</code> wants <code>mydomain.com</code> to point to a VM on CSC cloud.		Let's say user <code>ctdalek</code> wants <code>mydomain.com</code> to point to a VM on CSC cloud.
	<br>		<br>

N4chung: /* csclub.cloud */

2024-04-13T20:25:05Z

csclub.cloud

← Older revision		Revision as of 15:25, 13 April 2024
Line 70:		Line 70:

	=== csclub.cloud ===		=== csclub.cloud ===
	Once a year, someone from IST will ask us to create a temporary TXT record for csclub.cloud to prove to GlobalSign that we own it. This must be created at the <b>root</b> of the domain. Since this zone is managed dynamically (via the acme.sh script on biloba, see below), we need to freeze the domain and update /var/lib/bind/db.csclub.cloud directly. ~~Here are the steps:~~		Once a year, someone from IST will ask us to create a temporary TXT record for csclub.cloud to prove to GlobalSign that we own it. This must be created at the <b>root</b> of the domain. Since this zone is managed dynamically (via the acme.sh script on biloba, see below), we need to freeze the domain and update /var/lib/bind/db.csclub.cloud directly.

			Once you're in the correct server (not Biloba). Here are the steps:
	<ol>		<ol>
	<li>Run <code>rndc freeze csclub.cloud</code>.</li>		<li>Run <code>rndc freeze csclub.cloud</code>.</li>

Merenber: /* Certificate Locations */

2023-10-24T17:13:45Z

Certificate Locations

← Older revision		Revision as of 12:13, 24 October 2023
Line 137:		Line 137:
	* caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)		* caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)
	* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)		* coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)
	* mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)		* <s>mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)</s> (UPDATE: we use certbot now for these)
	* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)		* mailman:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
	* rt:/etc/ssl/private/csclub-wildcard.crt (for Apache)		* rt:/etc/ssl/private/csclub-wildcard.crt (for Apache)

Merenber: /* Certificate Locations */

2023-10-20T10:13:40Z

Certificate Locations

← Older revision		Revision as of 05:13, 20 October 2023
Line 153:		Line 153:
	* biloba:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* biloba:/etc/ssl/private/cloud.csclub.uwaterloo.ca.chain.crt, /etc/ssl/private/csclub.cloud.chain, /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)		* nextcloud (nspawn container inside guayusa): /etc/ssl/private/csclub.uwaterloo.ca.chain (for nginx)
	* citric-acid (runs vaultwarden): /etc/ssl/private/csclub.uwaterloo.ca.{chain,key}		* citric-acid (runs vaultwarden): /etc/ssl/private/csclub.uwaterloo.ca.{chain,key} (for nginx)

	Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.		Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.