You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2021/07/14 21:06:20 UTC
[GitHub] [trafficcontrol] mattjackson220 opened a new pull request #6024: Generate a self signed cert on ds creation/update
mattjackson220 opened a new pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024
<!--
************ STOP!! ************
If this Pull Request is intended to fix a security vulnerability, DO NOT submit it! Instead, contact
the Apache Software Foundation Security Team at security@trafficcontrol.apache.org and follow the
guidelines at https://www.apache.org/security/ regarding vulnerability disclosure.
-->
## What does this PR (Pull Request) do?
<!-- Explain the changes you made here. If this fixes an Issue, identify it by
replacing the text in the checkbox item with the Issue number e.g.
- [x] This PR fixes #9001 OR is not related to any Issue
^ This will automatically close Issue number 9001 when the Pull Request is
merged (The '#' is important).
Be sure you check the box properly, see the "The following criteria are ALL
met by this PR" section for details.
-->
- [x] This PR fixes #5893 <!-- You can check for an issue here: https://github.com/apache/trafficcontrol/issues -->
This PR updates TO so that when a new HTTPS delivery service is created or an HTTP delivery service is updated to HTTPS, a self signed certificate is created as a placeholder.
## Which Traffic Control components are affected by this PR?
<!-- Please delete all components from this list that are NOT affected by this
Pull Request. Also, feel free to add the name of a tool or script that is
affected but not on the list.
Additionally, if this Pull Request does NOT affect documentation, please
explain why documentation is not required. -->
- Traffic Ops
## What is the best way to verify this PR?
<!-- Please include here ALL the steps necessary to test your Pull Request. If
it includes tests (and most should), outline here the steps needed to run the
tests. If not, lay out the manual testing procedure and please explain why
tests are unnecessary for this Pull Request. -->
Create a new HTTPS DS and verify that a self signed certificate is generated and stored
Create an HTTP DS and verify that no cert is generated
Update that HTTP DS to use HTTPS and verify that a self signed cert is generated and stored
Update an existing HTTPS DS that already has a cert and verify that the previous cert remains unchanged
Verify that all other DS creation / update functionality is unchanged
## If this is a bug fix, what versions of Traffic Control are affected?
<!-- If this PR fixes a bug, please list here all of the affected versions - to
the best of your knowledge. It's also pretty helpful to include a commit hash
of where 'master' is at the time this PR is opened (if it affects master),
because what 'master' means will change over time. For example, if this PR
fixes a bug that's present in master (at commit hash '1df853c8'), in v4.0.0,
and in the current 4.0.1 Release candidate (e.g. RC1), then this list would
look like:
- master (1df853c8)
- 4.0.0
- 4.0.1 (RC1)
If you don't know what other versions might have this bug, AND don't know how
to find the commit hash of 'master', then feel free to leave this section
blank (or, preferably, delete it entirely).
-->
## The following criteria are ALL met by this PR
<!-- Check the boxes to signify that the associated statement is true. To
"check a box", replace the space inside of the square brackets with an 'x'.
e.g.
- [ x] <- Wrong
- [x ] <- Wrong
- [] <- Wrong
- [*] <- Wrong
- [x] <- Correct!
-->
This test does not include docs or tests since it is a minor change that will not impact these
- [x] This PR includes tests OR I have explained why tests are unnecessary
- [x] This PR includes documentation OR I have explained why documentation is unnecessary
- [x] This PR includes an update to CHANGELOG.md OR such an update is not necessary
- [x] This PR includes any and all required license headers
- [x] This PR **DOES NOT FIX A SERIOUS SECURITY VULNERABILITY** (see [the Apache Software Foundation's security guidelines](https://www.apache.org/security/) for details)
## Additional Information
<!-- If you would like to include any additional information on the PR for
potential reviewers please put it here.
Some examples of this would be:
- Before and after screenshots/gifs of the Traffic Portal if it is affected
- Links to other dependent Pull Requests
- References to relevant context (e.g. new/updates to dependent libraries,
mailing list records, blueprints)
Feel free to leave this section blank (or, preferably, delete it entirely).
-->
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mattjackson220 commented on a change in pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
mattjackson220 commented on a change in pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#discussion_r675165127
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
Review comment:
i think it will after the switch to using `createV40` and `updateV40` so ill get rid of this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] rawlinp commented on pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
rawlinp commented on pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#issuecomment-891096362
I like that idea. Just make the new config optional and use `placeholder` by default 👍
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mattjackson220 commented on a change in pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
mattjackson220 commented on a change in pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#discussion_r675164808
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -87,9 +90,9 @@ func GenerateSSLKeys(w http.ResponseWriter, r *http.Request) {
api.WriteResp(w, r, "Successfully created ssl keys for "+*req.DeliveryService)
}
-// generatePutRiakKeys generates a certificate, csr, and key from the given request, and insert it into the Riak key database.
+// GeneratePutRiakKeys generates a certificate, csr, and key from the given request, and insert it into the Riak key database.
// The req MUST be validated, ensuring required fields exist.
-func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv trafficvault.TrafficVault, ctx context.Context) error {
+func GeneratePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv trafficvault.TrafficVault, ctx context.Context) error {
Review comment:
my bad. leftover from when i had the `GeneratePlaceHolderSelfSignedCert` in a different file. fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] jhg03a commented on pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
jhg03a commented on pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#issuecomment-904751590
Closes #2429
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] rawlinp commented on a change in pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
rawlinp commented on a change in pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#discussion_r712498129
##########
File path: traffic_ops/traffic_ops_golang/config/config.go
##########
@@ -173,6 +174,14 @@ type ConfigAcmeAccount struct {
HmacEncoded string `json:"hmac_encoded"`
}
+type DefaultCertificateInfo struct {
Review comment:
Can we add some config validation to ensure that if the config contains the `default_certificate_info` section, that all the fields within it are non-empty? I'm not sure if that would cause the certificate generation to fail or not, but I'd think if there were any empty fields that it would be unintentional.
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
Review comment:
So I think this went back and forth, but are we not able to use `inf.Tx.Tx` here? It seems like maybe there was a missing nil pointer check that ended up fixing the tests?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] rawlinp commented on a change in pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
rawlinp commented on a change in pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#discussion_r671519385
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
Review comment:
Per one of my prior comments, we would make this use the `DeliveryServiceV4` alias instead of `v40` if the check and generation are moved into the `createV40` and `updateV40` functions. That alias is meant to make things future-proof, i.e. as we add minor API versions, e.g. `DeliveryServiceV41`, the alias would be re-aliased to the latest version so basically all the functions still work without needing updated.
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
Review comment:
Does using `inf.Tx.Tx` not work?
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ defer tx.Commit()
+
+ cdnName, cdnDomain, err := getCDNNameDomain(*ds.CDNID, tx)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+
+ cdnNameStr := string(cdnName)
+
+ if ds.ExampleURLs == nil {
+ ds.ExampleURLs = MakeExampleURLs(ds.Protocol, *ds.Type, *ds.RoutingName, *ds.MatchList, cdnDomain)
+ }
+
+ hostname := strings.Split(ds.ExampleURLs[0], "://")[1]
+ if strings.Contains(ds.Type.String(), "HTTP") {
+ parts := strings.Split(hostname, ".")
+ parts[0] = "*"
+ hostname = strings.Join(parts, ".")
+ }
+
+ req := tc.DeliveryServiceGenSSLKeysReq{
+ DeliveryServiceSSLKeysReq: tc.DeliveryServiceSSLKeysReq{
+ CDN: &cdnNameStr,
+ DeliveryService: ds.XMLID,
+ HostName: &hostname,
+ Key: ds.XMLID,
+ Version: &version,
+ BusinessUnit: util.StrPtr("Placeholder"),
+ City: util.StrPtr("Placeholder"),
+ Organization: util.StrPtr("Placeholder"),
+ Country: util.StrPtr("United States (US)"),
Review comment:
Does "Placeholder" not work for country and state? If not, disregard :)
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ defer tx.Commit()
+
+ cdnName, cdnDomain, err := getCDNNameDomain(*ds.CDNID, tx)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+
+ cdnNameStr := string(cdnName)
+
+ if ds.ExampleURLs == nil {
+ ds.ExampleURLs = MakeExampleURLs(ds.Protocol, *ds.Type, *ds.RoutingName, *ds.MatchList, cdnDomain)
+ }
+
+ hostname := strings.Split(ds.ExampleURLs[0], "://")[1]
+ if strings.Contains(ds.Type.String(), "HTTP") {
+ parts := strings.Split(hostname, ".")
+ parts[0] = "*"
+ hostname = strings.Join(parts, ".")
+ }
+
+ req := tc.DeliveryServiceGenSSLKeysReq{
+ DeliveryServiceSSLKeysReq: tc.DeliveryServiceSSLKeysReq{
+ CDN: &cdnNameStr,
+ DeliveryService: ds.XMLID,
+ HostName: &hostname,
+ Key: ds.XMLID,
+ Version: &version,
+ BusinessUnit: util.StrPtr("Placeholder"),
+ City: util.StrPtr("Placeholder"),
+ Organization: util.StrPtr("Placeholder"),
+ Country: util.StrPtr("United States (US)"),
+ State: util.StrPtr("CO"),
+ },
+ }
+ if err := GeneratePutRiakKeys(req, tx, inf.Vault, context); err != nil {
+ return errors.New("generating and putting SSL keys: " + err.Error()), http.StatusInternalServerError
+ }
+ if err := updateSSLKeyVersion(*req.DeliveryService, req.Version.ToInt64(), tx); err != nil {
+ return errors.New("generating SSL keys for delivery service '" + *req.DeliveryService + "': " + err.Error()), http.StatusInternalServerError
+ }
+
+ return nil, http.StatusOK
+}
+
+func getCDNNameDomain(cdnID int, tx *sql.Tx) (string, string, error) {
Review comment:
This function should probably go in db_helpers.go since it might be useful to other packages as well.
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/deliveryservices.go
##########
@@ -878,6 +888,16 @@ func UpdateV40(w http.ResponseWriter, r *http.Request) {
}
alerts := res.TLSVersionsAlerts()
alerts.AddNewAlert(tc.SuccessLevel, "Delivery Service update was successful")
+
+ if inf.Config.TrafficVaultEnabled && (*ds.Protocol == tc.DSProtocolHTTPS || *ds.Protocol == tc.DSProtocolHTTPAndHTTPS) && (ds.SSLKeyVersion == nil || *ds.SSLKeyVersion == 0) {
Review comment:
ditto my prior comment, except `updateV40` instead of `createv40` on the last point
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/deliveryservices.go
##########
@@ -277,6 +277,16 @@ func CreateV40(w http.ResponseWriter, r *http.Request) {
}
alerts := res.TLSVersionsAlerts()
alerts.AddNewAlert(tc.SuccessLevel, "Delivery Service creation was successful")
+
+ if inf.Config.TrafficVaultEnabled && (*ds.Protocol == tc.DSProtocolHTTPS || *ds.Protocol == tc.DSProtocolHTTPAndHTTPS) && (ds.SSLKeyVersion == nil || *ds.SSLKeyVersion == 0) {
Review comment:
I wonder if we should also include `DSProtocolHTTPToHTTPS` even though this is about preventing TR from spinning. That way, we can say any DS that uses HTTPS will have a default cert generated for it.
Also, I'm not sure checking `ds.SSLKeyVersion == nil || *ds.SSLKeyVersion == 0` is really necessary, since this DS can't possibly have certs assigned yet because the DS doesn't exist yet. However, I suppose if it were deleted and recreated (which needs to happen from time to time), it might have certs already. Should we attempt to pull the `latest` cert from Traffic Vault, and if it doesn't exist, we can generate the default one?
Also, this check and cert generation should probably go into `createV40`, because we'd want this to be done for all API versions, right?
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -87,9 +90,9 @@ func GenerateSSLKeys(w http.ResponseWriter, r *http.Request) {
api.WriteResp(w, r, "Successfully created ssl keys for "+*req.DeliveryService)
}
-// generatePutRiakKeys generates a certificate, csr, and key from the given request, and insert it into the Riak key database.
+// GeneratePutRiakKeys generates a certificate, csr, and key from the given request, and insert it into the Riak key database.
// The req MUST be validated, ensuring required fields exist.
-func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv trafficvault.TrafficVault, ctx context.Context) error {
+func GeneratePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv trafficvault.TrafficVault, ctx context.Context) error {
Review comment:
Why make this public? Since `GeneratePlaceholderSelfSignedCert` is public and in the same package, it could still make use of `GeneratePutRiakKeys` if it were private.
Also, we should probably rename this to `generatePutTrafficVaultSSLKeys` and update the comment since this isn't Riak-specific anymore.
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ defer tx.Commit()
+
+ cdnName, cdnDomain, err := getCDNNameDomain(*ds.CDNID, tx)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+
+ cdnNameStr := string(cdnName)
+
+ if ds.ExampleURLs == nil {
+ ds.ExampleURLs = MakeExampleURLs(ds.Protocol, *ds.Type, *ds.RoutingName, *ds.MatchList, cdnDomain)
+ }
+
+ hostname := strings.Split(ds.ExampleURLs[0], "://")[1]
+ if strings.Contains(ds.Type.String(), "HTTP") {
Review comment:
I think we may be able to change this to `if ds.Type.IsHTTP()`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] mattjackson220 commented on a change in pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
mattjackson220 commented on a change in pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#discussion_r675165394
##########
File path: traffic_ops/traffic_ops_golang/deliveryservice/sslkeys.go
##########
@@ -115,3 +118,70 @@ func generatePutRiakKeys(req tc.DeliveryServiceGenSSLKeysReq, tx *sql.Tx, tv tra
}
return nil
}
+
+// GeneratePlaceholderSelfSignedCert generates a self-signed SSL certificate as a placeholder when a new HTTPS
+// delivery service is created or an HTTP delivery service is updated to use HTTPS.
+func GeneratePlaceholderSelfSignedCert(ds tc.DeliveryServiceV40, inf *api.APIInfo, context context.Context) (error, int) {
+ version := util.JSONIntStr(1)
+
+ db, err := api.GetDB(context)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ tx, err := db.Begin()
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+ defer tx.Commit()
+
+ cdnName, cdnDomain, err := getCDNNameDomain(*ds.CDNID, tx)
+ if err != nil {
+ return err, http.StatusInternalServerError
+ }
+
+ cdnNameStr := string(cdnName)
+
+ if ds.ExampleURLs == nil {
+ ds.ExampleURLs = MakeExampleURLs(ds.Protocol, *ds.Type, *ds.RoutingName, *ds.MatchList, cdnDomain)
+ }
+
+ hostname := strings.Split(ds.ExampleURLs[0], "://")[1]
+ if strings.Contains(ds.Type.String(), "HTTP") {
+ parts := strings.Split(hostname, ".")
+ parts[0] = "*"
+ hostname = strings.Join(parts, ".")
+ }
+
+ req := tc.DeliveryServiceGenSSLKeysReq{
+ DeliveryServiceSSLKeysReq: tc.DeliveryServiceSSLKeysReq{
+ CDN: &cdnNameStr,
+ DeliveryService: ds.XMLID,
+ HostName: &hostname,
+ Key: ds.XMLID,
+ Version: &version,
+ BusinessUnit: util.StrPtr("Placeholder"),
+ City: util.StrPtr("Placeholder"),
+ Organization: util.StrPtr("Placeholder"),
+ Country: util.StrPtr("United States (US)"),
Review comment:
haha i think it will work but it felt weird. updated now
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] rawlinp merged pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
rawlinp merged pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] smalenfant commented on pull request #6024: Generate a self signed cert on ds creation/update
Posted by GitBox <gi...@apache.org>.
smalenfant commented on pull request #6024:
URL: https://github.com/apache/trafficcontrol/pull/6024#issuecomment-890527037
Would there be a way to configure these so the CSR is valid to use after being auto-generated? That would mean new configuration.
```
BusinessUnit: util.StrPtr("Placeholder"),
City: util.StrPtr("Placeholder"),
Organization: util.StrPtr("Placeholder"),
Country: util.StrPtr("Placeholder"),
State: util.StrPtr("Placeholder"),
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficcontrol.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org