diff --git a/commander b/commander index 3c9b6eb..8102763 100755 --- a/commander +++ b/commander @@ -41,6 +41,10 @@ case $txt in cp /etc/nginx/ssl/labca_cert.pem /usr/local/share/ca-certificates/labca_cert.crt cp ~labca/admin/data/root-ca.pem /usr/local/share/ca-certificates/root-ca.crt update-ca-certificates &>>$LOGFILE + echo "Waiting for initial startup of the docker containers..." &>>$LOGFILE + wait_up $PS_MYSQL &>>$LOGFILE + wait_up $PS_LABCA &>>$LOGFILE + wait_up $PS_BOULDER $PS_BOULDER_COUNT &>>$LOGFILE ;; "docker-restart") cd /home/labca/boulder diff --git a/gui/apply-boulder b/gui/apply-boulder index a2e20d5..c2ee912 100755 --- a/gui/apply-boulder +++ b/gui/apply-boulder @@ -15,21 +15,35 @@ sed -i -e "s/\"issuerDomain\": \".*\"/\"issuerDomain\": \"$PKI_DOMAIN\"/" config sed -i -e "s/\"directoryCAAIdentity\": \".*\"/\"directoryCAAIdentity\": \"$PKI_DOMAIN\"/" config/wfe.json sed -i -e "s/\"directoryCAAIdentity\": \".*\"/\"directoryCAAIdentity\": \"$PKI_DOMAIN\"/" config/wfe2.json +if ([ "$PKI_DOMAIN_MODE" == "lockdown" ] && [ "$PKI_LOCKDOWN_DOMAINS" != "" ]) || ([ "$PKI_DOMAIN_MODE" == "whitelist" ] && [ "$PKI_WHITELIST_DOMAINS" != "" ]); then + perl -i -p0e "s/(\"badResultsOnly\":.*?\n)/\1 \"skipForbiddenDomains\": true,\n/igs" config/cert-checker.json + perl -i -p0e "s/(\s+\"ignoredLints\": \[\n)/\1 \"e_dnsname_not_valid_tld\",\n/igs" config/cert-checker.json +fi + [ -e ../test/hostname-policy.yaml ] && cp ../test/hostname-policy.yaml ./ || true [ -e ../boulder/test/hostname-policy.yaml ] && cp ../boulder/test/hostname-policy.yaml ./ || true [ -e hostname-policy.json ] && rm hostname-policy.json || true [ -e config/ca.json ] && rm config/ca.json || true [ -e config/expired-authz-purger2.json ] && rm config/expired-authz-purger2.json || true [ -e config/janitor.json ] && rm config/janitor.json || true -cat hostname-policy.yaml | tr '\n' '\r' | sed -e "s/Lockdown:.*//" | tr '\r' '\n' > hostname-policy.yaml.bak && mv hostname-policy.yaml.bak hostname-policy.yaml -cat hostname-policy.yaml | tr '\n' '\r' | sed -e "s/Whitelist:.*//" | tr '\r' '\n' > hostname-policy.yaml.bak && mv hostname-policy.yaml.bak hostname-policy.yaml +cat hostname-policy.yaml | tr '\n' '\r' | sed -e "s/\r# Lockdown.*//" | tr '\r' '\n' > hostname-policy.yaml.bak && mv hostname-policy.yaml.bak hostname-policy.yaml +cat hostname-policy.yaml | tr '\n' '\r' | sed -e "s/\r# Whitelist.*//" | tr '\r' '\n' > hostname-policy.yaml.bak && mv hostname-policy.yaml.bak hostname-policy.yaml if [ "$PKI_DOMAIN_MODE" == "lockdown" ] && [ "$PKI_LOCKDOWN_DOMAINS" != "" ]; then + echo >> hostname-policy.yaml + echo "# Lockdown are the domains that this LabCA instance can issue certificates for" >> hostname-policy.yaml echo "Lockdown:" >> hostname-policy.yaml - echo " - \"$PKI_LOCKDOWN_DOMAINS\"" >> hostname-policy.yaml + for d in $(echo $PKI_LOCKDOWN_DOMAINS | sed -e "s/\\\r\\\n/ /g" | tr '\r' ' '); do + echo " - \"$d\"" >> hostname-policy.yaml + done fi if [ "$PKI_DOMAIN_MODE" == "whitelist" ] && [ "$PKI_WHITELIST_DOMAINS" != "" ]; then + echo >> hostname-policy.yaml + echo "# Whitelist are the domains that this LabCA instance can issue certificates for" >> hostname-policy.yaml + echo "in *addition* to all normal public domains" >> hostname-policy.yaml echo "Whitelist:" >> hostname-policy.yaml - echo " - \"$PKI_WHITELIST_DOMAINS\"" >> hostname-policy.yaml + for d in $(echo $PKI_WHITELIST_DOMAINS | sed -e "s/\\\r\\\n/ /g" | tr '\r' ' '); do + echo " - \"$d\"" >> hostname-policy.yaml + done fi if [ "$PKI_DOMAIN_MODE" == "lockdown" ] || [ "$PKI_DOMAIN_MODE" == "whitelist" ]; then sed -i -e "s/\(\"n_subject_common_name_included\"\)/\1,\"e_dnsname_not_valid_tld\"/" config/ca-a.json @@ -37,10 +51,14 @@ if [ "$PKI_DOMAIN_MODE" == "lockdown" ] || [ "$PKI_DOMAIN_MODE" == "whitelist" ] REPLACEMENT="" if [ "$PKI_DOMAIN_MODE" == "lockdown" ] && [ "$PKI_LOCKDOWN_DOMAINS" != "" ]; then - REPLACEMENT=" $PKI_LOCKDOWN_DOMAINS: 10000\n" + for d in $(echo $PKI_LOCKDOWN_DOMAINS | sed -e "s/\\\r\\\n/ /g" | tr '\r' ' '); do + REPLACEMENT+=" $d: 10000\n" + done fi if [ "$PKI_DOMAIN_MODE" == "whitelist" ] && [ "$PKI_WHITELIST_DOMAINS" != "" ]; then - REPLACEMENT=" $PKI_WHITELIST_DOMAINS: 10000\n" + for d in $(echo $PKI_WHITELIST_DOMAINS | sed -e "s/\\\r\\\n/ /g" | tr '\r' ' '); do + REPLACEMENT=" $d: 10000\n" + done fi cat rate-limit-policies.yml | tr '\n' '\r' | sed -e "s/\(must-staple.le.wtf: 10000\).*\( registrationOverrides:\)/\1\n$REPLACEMENT\2/" | tr '\r' '\n' > rate-limit-policies.yml.bak && mv rate-limit-policies.yml.bak rate-limit-policies.yml cat rate-limit-policies.yml | tr '\n' '\r' | sed -e "s/\(certificatesPerFQDNSet:.*must-staple.le.wtf: 10000\).*/\1\n$REPLACEMENT/" | tr '\r' '\n' > rate-limit-policies.yml.bak && mv rate-limit-policies.yml.bak rate-limit-policies.yml diff --git a/gui/dashboard.go b/gui/dashboard.go index 9d3613f..47fd3e5 100644 --- a/gui/dashboard.go +++ b/gui/dashboard.go @@ -106,6 +106,12 @@ func _parseLine(line string, loc *time.Location) Activity { message = message[0:idx] } } + if strings.Index(message, "failed to complete security handshake") > -1 { + activity.Class = "warning" + } + if strings.Index(message, "failed to receive the preface from client") > -1 { + activity.Class = "warning" + } activity.Message = message return activity diff --git a/gui/main.go b/gui/main.go index 646dfd2..dbd9b88 100644 --- a/gui/main.go +++ b/gui/main.go @@ -2405,7 +2405,7 @@ func init() { if key == nil { panic(fmt.Errorf("fatal error random key")) } - viper.Set("keys.auth", key) + viper.Set("keys.auth", base64.StdEncoding.EncodeToString(key)) viper.WriteConfig() } if viper.Get("keys.enc") == nil { @@ -2413,7 +2413,7 @@ func init() { if key == nil { panic(fmt.Errorf("fatal error random key")) } - viper.Set("keys.enc", key) + viper.Set("keys.enc", base64.StdEncoding.EncodeToString(key)) viper.WriteConfig() } diff --git a/gui/templates/views/cert.tmpl b/gui/templates/views/cert.tmpl index 8dda835..e5ccf9f 100644 --- a/gui/templates/views/cert.tmpl +++ b/gui/templates/views/cert.tmpl @@ -2,7 +2,7 @@
{{with .CertificateInfo}} -

{{ if .IsRoot }}Root{{ else }}Issuer (2nd level){{ end }} Certificate

+

{{ if .IsRoot }}Root{{ else }}Issuer (2nd level){{ end }} Certificate