The CSC currently has an SSL Certificate from GlobalSign for *.csclub.uwaterloo.ca provided at no cost to us through IST. GlobalSign likes to take a long time to respond to certificate signing requests (CSR) for wildcard certs, so our CSR really needs to be handed off to IST at least 2 weeks in advance. You can do it sooner – the certificate expiry date will be the old expiry date + 1 year (+ a bonus ) Having an invalid cert for any length of time leads to terrible breakage, followed by terrible workarounds and prolonged problems.
When the certificate is due to expire in a month or two, syscom should (but apparently doesn't always) get an email notification. This will include a renewal link. Otherwise, use the IST-CA self service system. Please keep a copy of the key, CSR and (once issued) certificate in /home/sysadmin/certs. The OpenSSL examples linked there are good to generate a 2048-bit RSA key and a corresponding CSR. It's probably a good idea to change the private key (as it's not that much effort anyways). Just sure your CSR is for *.csclub.uwaterloo.ca.
At the self-service portal, these options worked in 2013. If you need IST assistance, firstname.lastname@example.org is the email address you should contact.
Products: OrganizationSSL SSL Certificate Type: Wildcard SSL Certificate Validity Period: 1 year Are you switching from a Competitor? No, I am not switching Are you renewing this Certificate? Yes (paste current certificate) 30-day bonus: Yes (why not?) Add specific Subject Alternative Names (SANs): No (*.csclub.uwaterloo.ca automatically adds csclub.uwaterloo.ca as a SAN) Enter Certificate Signing Request (CSR): Yes (paste CSR) Contact Information: First Name: Computer Science Club Last Name: Systems Committee Telephone: +1 519 888 4567 x33870 Email Address: email@example.com
- How to generate a new CSR and private key
- How to obtain a new GlobalSign certificate or renew an existing one
- GlobalSign UWaterloo self-service page
- GlobalSign intermediate certificate (needed to create a certificate chain; see below)
OpenSSL cheat sheet
Generate a new CSR and private key (do this in a new directory):
openssl req -out csclub.uwaterloo.ca.csr -new -newkey rsa:2048 -keyout csclub.uwaterloo.ca.key -nodes
View the information inside a CSR:
openssl req -noout -text -in csclub.uwaterloo.ca.csr
View the information inside a private key:
openssl pkey -noout -text -in csclub.uwaterloo.ca.key
View information inside a certificate:
openssl x509 -noout -text -in csclub.uwaterloo.ca.crt
Keep a copy of newly generated certificates in /home/sysadmin/certs on the NFS server (currently xylitol).
A list of places you'll need to put the new certificate to keep our services running. Private key (if applicable) should be kept next to the certificate with the extension .key.
- caffeine:/etc/ssl/private/csclub-wildcard.crt (for Apache)
- coffee:/etc/ssl/private/csclub.uwaterloo.ca (for PostgreSQL and MariaDB)
- mail:/etc/ssl/private/csclub-wildcard.crt (for Apache, Postfix and Dovecot)
- rt:/etc/ssl/private/csclub-wildcard.crt (for Apache)
- potassium-benzoate:/etc/ssl/private/csclub-wildcard.crt (for nginx)
- auth1:/etc/ssl/private/csclub-wildcard.crt (for slapd)
- auth2:/etc/ssl/private/csclub-wildcard.crt (for slapd)
- logstash:/etc/ssl/private/csclub-wildcard.crt (for nginx) [temporarily down 2020]
- mattermost:/etc/ssl/private/csclub-wildcard.crt (for nginx)
- load-balancer-0(1|2):/etc/ssl/private/csclub.uwaterloo.ca (for haproxy) [temporarily down 2020]
- chat:/etc/ssl/private/csclub-wildcard-chain.crt (for nginx)
- znc:/etc/ssl/private/csclub-wildcard-chain.crt (for ZNC and nginx)
- prometheus:/etc/ssl/private/csclub-wildcard-chain.crt (for Apache)
- bigbluebutton:/etc/nginx/ssl/csclub-wildcard-chain.crt (for nginx)
- icy:/etc/ssl/private/csclub-wildcard.pem (for Icecast)
- ci:/etc/ssl/private/csclub-wildcard-chain.crt (for drone.io) (this is the gitlabrunner container running under the lxcuser0 user on xylitol)
Some services (e.g. Dovecot, Postfix) prefer to have the certificate chain in one file. Concatenate the appropriate intermediate root to the end of the certificate and store this as csclub-wildcard-chain.crt.
We support letsencrypt for our virtual hosts with custom domains. We use the cerbot from debian repositories with a configuration file at /etc/letsencrypt/cli.ini, and a systemd timer to handle renewals.
The setup for a new domain is:
- Become certbot on caffine with sudo -u certbot bash or similar.
- Run certbot certonly -c /etc/letsencrypt/cli.ini -d DOMAIN --logs-dir /tmp. The logs-dir isn't important and is only needed for troubleshooting.
- Set up the Apache site configuration using the example below. (apache config is in /etc/apache2) Note the permanent redirect to https.
- Make sure to commit your changes when you're done.
- Reloading apache config is sudo systemctl reload apache2.
<VirtualHost *:80> ServerName example.com ServerAlias *.example.com ServerAdmin firstname.lastname@example.org #DocumentRoot /users/example/www/ Redirect permanent / https://example.com/ ErrorLog /var/log/apache2/example-error.log CustomLog /var/log/apache2/example-access.log combined </VirtualHost> <VirtualHost csclub:443> SSLEngine on SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem SSLStrictSNIVHostCheck on ServerName example.com ServerAlias *.example.com ServerAdmin email@example.com DocumentRoot /users/example/www ErrorLog /var/log/apache2/example-error.log CustomLog /var/log/apache2/example-access.log combined </VirtualHost>