fd6240772e
Documentation: - certs/README.md: Complete guide for managing nginx TLS certificates - Server cert generation (self-signed, CA-signed, Let's Encrypt) - Certificate expiry monitoring and renewal procedures - Agent certificate pinning configuration - Air-gapped deployment notes Tooling: - certs/regenerate-server-cert.sh: Bash script for cert regeneration - certs/regenerate-server-cert.ps1: PowerShell script for Windows - Both scripts backup old certs and display new thumbprint Config: - Updated .gitignore to allow cert management files (docs/scripts/config) - Private keys and actual certificates still excluded (security) Context: - User asked where to manage server-side certificate - Current cert: self-signed, CN=localhost, valid 1 year - Agents validate server cert via pinning or Windows trusted roots - Critical for mTLS client cert authentication (ADR-006) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
54 lines
1.8 KiB
PowerShell
54 lines
1.8 KiB
PowerShell
# Regenerate self-signed server certificate for ShopDB nginx
|
|
# Run from repository root: .\certs\regenerate-server-cert.ps1
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$CertDir = "certs"
|
|
$DaysValid = 365
|
|
|
|
Write-Host "=== ShopDB Server Certificate Generator ===" -ForegroundColor Cyan
|
|
Write-Host ""
|
|
|
|
# Check if running from repo root
|
|
if (-not (Test-Path "docker-compose.yml")) {
|
|
Write-Host "ERROR: Must run from repository root" -ForegroundColor Red
|
|
Write-Host "Usage: .\certs\regenerate-server-cert.ps1"
|
|
exit 1
|
|
}
|
|
|
|
# Backup old certificate
|
|
if (Test-Path "$CertDir\server.crt") {
|
|
Write-Host "Backing up existing certificate..."
|
|
Copy-Item "$CertDir\server.crt" "$CertDir\server.crt.backup" -Force
|
|
Copy-Item "$CertDir\server.key" "$CertDir\server.key.backup" -Force
|
|
|
|
$oldExpiry = openssl x509 -in "$CertDir\server.crt" -noout -enddate 2>$null
|
|
Write-Host " Old certificate: $oldExpiry"
|
|
}
|
|
|
|
# Generate new certificate
|
|
Write-Host ""
|
|
Write-Host "Generating new self-signed certificate (valid $DaysValid days)..." -ForegroundColor Yellow
|
|
|
|
openssl req -x509 -newkey rsa:2048 -nodes `
|
|
-keyout "$CertDir\server.key" `
|
|
-out "$CertDir\server.crt" `
|
|
-days $DaysValid `
|
|
-config "$CertDir\openssl.cnf" 2>$null
|
|
|
|
Write-Host ""
|
|
Write-Host "Certificate generated successfully!" -ForegroundColor Green
|
|
Write-Host ""
|
|
|
|
# Show certificate details
|
|
Write-Host "=== Certificate Details ===" -ForegroundColor Cyan
|
|
openssl x509 -in "$CertDir\server.crt" -noout -subject -dates -fingerprint -sha256
|
|
|
|
Write-Host ""
|
|
Write-Host "=== Next Steps ===" -ForegroundColor Yellow
|
|
Write-Host "1. Restart nginx: docker-compose restart nginx"
|
|
Write-Host "2. If agents use ServerCertThumbprint pinning:"
|
|
Write-Host " - Update appsettings.json with new thumbprint (shown above)"
|
|
Write-Host " - Restart all agents BEFORE old certificate expires"
|
|
Write-Host ""
|