http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #1 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 45397 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=45397&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #45397|0 |1 is obsolete| | Attachment #45399|0 |1 is obsolete| | --- Comment #3 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 45400 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=45400&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #45400|0 |1 is obsolete| | --- Comment #4 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 45402 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=45402&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #6 from Mirko Tietgen <mirko@abunchofthings.net> --- The server this is tested on has to be accessible on port 80 from the outside world. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #45408|0 |1 is obsolete| | --- Comment #8 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 45409 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=45409&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt <instance> - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites Todo - use letsencrypt default path in debian when we know where that is - enable redirect from port 80 to https in apache config -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #9 from Mirko Tietgen <mirko@abunchofthings.net> ---

--letsencrypt /home/mirko/letsencrypt

Use your own /path/to/letsencryptfolder instead ;) -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #10 from Mirko Tietgen <mirko@abunchofthings.net> --- I have a much cleaner Apache config using Define. But then it would not work with Apache 2.2 :/ -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #45414|0 |1 is obsolete| | --- Comment #12 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 45415 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=45415&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects http to https New option --letsencrypt - sets the path where letsencrypt-auto lives - default value /usr/bin, but there is no Debian package yet Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt <instance> - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites - check that http redirects to https -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |gmcharlt@gmail.com --- Comment #14 from Galen Charlton <gmcharlt@gmail.com> --- Very promising start. Since the Let's Encrypt certificates are short-lived (90 days, IIRC), there will also need to be a mechanism in place to automatically renew them. An /etc/cron.monthly/koha-common might do for now (although I'm kinda hoping that the Debian Let's Encrypt packagers come up with a way to centralize management of the periodic cert renewals/replacmenets). -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #16 from Mirko Tietgen <mirko@abunchofthings.net> --- It would probably be better to have a single option for koha-create. Just --letsencrypt <path>, and if path is not given, use default /usr/bin. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |In Discussion --- Comment #18 from Mirko Tietgen <mirko@abunchofthings.net> --- Setting to in disussion for now, patch does not work atm. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #45415|0 |1 is obsolete| | --- Comment #19 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46116 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46116&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects http to https New option --letsencrypt - sets the path where letsencrypt-auto lives - default value /usr/bin, but there is no Debian package yet Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt <instance> - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites - check that http redirects to https -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #21 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46118 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46118&action=edit Bug 15303 Go back to old version of Apache template This version of the Apache template is less sophisticated, but should work with Apache 2.2 and 2.4. SSL options are commented out (#) in the beginning, ports are set to 80. When the certificated are available, ports are changed to 443, all # are removed for SSL options and HTTP redirect. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #23 from Mirko Tietgen <mirko@abunchofthings.net> --- I put some information for testers in the wiki at http://wiki.koha-community.org/wiki/LetsEncrypt I want to roll a package and test this again after the last changes before I set it back to needs signoff. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #46116|0 |1 is obsolete| | Attachment #46117|0 |1 is obsolete| | Attachment #46118|0 |1 is obsolete| | --- Comment #24 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46617 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46617&action=edit Bug 15303 Letsencrypt option for Debian package installations Apache file for https only setups with automatic certificate generation via letsencrypt. We need a workiung web server for the letsencrypt magic, but we can't start on 443 without certs. So we start on 80, get the certs, switch to 443 and restart apache. 80 gets forwarded to https. New option koha-create --force-https - generates letsencrypt certificates - sets up a https-only website - redirects http to https New option --letsencrypt - sets the path where letsencrypt-auto lives - default value /usr/bin, but there is no Debian package yet Test plan: - build a debian package with patch applied - checkout letsencrypt on the machine where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - Put your (existing) domain options in /etc/koha/koha-sites.conf - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt <instance> - wait until setup is finished, check that you got a working OPAC and staff client with certificates make sure to use https:// to open both sites - check that http redirects to https -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=15540 -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #25 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46742 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46742&action=edit Bug 15303 Use --staging during development to circumvent limits The --staging parameter uses the LE test server. This is only for testing, not supposed to go into master, no signoff needed. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 --- Comment #27 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46745 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46745&action=edit Bug 15303 LE production server Deletes the --staging option of the letsencrypt command to get real certificates. Rate limits apply. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #46742|0 |1 is obsolete| | --- Comment #29 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46747 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46747&action=edit Bug 15303 Workaround to use git ckeckout The Debian package letsencrypt is only available in unstable at the moment. To test without letsencrypt package: - apply this patch before you build the package - on the test vm/server: -- get letsencrypt via git git clone https://github.com/letsencrypt/letsencrypt -- create a symlink from /usr/bin/letsencrypt to letsencrypt-auto sudo ln -s /path/to/letsencrypt/letsencrypt-auto /usr/bin/letsencrypt -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #46746|0 |1 is obsolete| | --- Comment #31 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46749 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46749&action=edit Bug 15303 Letsencrypt option for Debian package installations New option koha-create --letsencrypt - installs the letsencrypt package if needed - creates <instance> - generates letsencrypt certificates for <instance> - sets up a https-only website for <instance> - redirects http to https for <instance> ! letsencrypt and dependencies are only available in debian unstable right now ! but koha-common does not work in debian unstable, so you cannot test there ! apply the "Workaround" patch to test without letsencrypt package ! this patch uses the letsencrypt staging server ! to create real certificates, apply thy "LE production server" patch Test plan: - build a debian package with patch applied - use apache mod_ssl sudo a2enmod ssl - make sure the machine is accessible on 80 (needed for letsencrypt) and 443 from the internet - install koha with your new package - Put your (existing) domain options in /etc/koha/koha-sites.conf - use koha-create with the new options: sudo koha-create --create-db --letsencrypt <instance> - if you do not have the letsencrypt package installed, you will be prompted to do that [ as long as there is no package available, a symlink to the git checkout will work ] - wait until setup is finished, check that you got a working OPAC and staff client with certificates - check that http redirects to https Bug 15303 Recreate accidentally deleted C4/Auth_cas_servers.yaml.orig -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15303 Mirko Tietgen <mirko@abunchofthings.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #46748|0 |1 is obsolete| | --- Comment #33 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 46751 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=46751&action=edit Bug 15303 LE production server Deletes the --staging option of the letsencrypt command to get real certificates. Rate limits apply. -- You are receiving this mail because: You are watching all bug changes.