opendev/system-config
Code Issues Proposed changes

Use LE cert on review.open*.org

Browse Source 
We previously had two manually issued certs (one each for opendev.org
and openstack.org) but now have a single cert with all the appropriate
names in it automatically issued by LE. Use this new cert before the old
one expires.

Change-Id: I635d2bfd820fe138ee951833dd66f157b2b7c097
This commit is contained in:
Clark Boylan
2020-02-28 08:10:24 -08:00
parent d75d70b333
commit 61caec5b77
3 changed files with 10 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/openstack_project/templates/review-openstack-redirect.vhost.erb
View File

@@ -24,9 +24,9 @@
# only is guarenteed.
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
SSLHonorCipherOrder on
SSLCertificateFile /etc/ssl/certs/review-redirect.openstack.org.pem
SSLCertificateKeyFile /etc/ssl/private/review-redirect.openstack.org.key
SSLCertificateChainFile /etc/ssl/certs/review-redirect.openstack.org_intermediate.pem
SSLCertificateFile /etc/letsencrypt-certs/review.opendev.org/review.opendev.org.cer
SSLCertificateKeyFile /etc/letsencrypt-certs/review.opendev.org/review.opendev.org.key
SSLCertificateChainFile /etc/letsencrypt-certs/review.opendev.org/ca.cer
LogLevel warn
ErrorLog /var/log/apache2/<%= @srvname %>_error.log