fd6240772e
Documentation: - certs/README.md: Complete guide for managing nginx TLS certificates - Server cert generation (self-signed, CA-signed, Let's Encrypt) - Certificate expiry monitoring and renewal procedures - Agent certificate pinning configuration - Air-gapped deployment notes Tooling: - certs/regenerate-server-cert.sh: Bash script for cert regeneration - certs/regenerate-server-cert.ps1: PowerShell script for Windows - Both scripts backup old certs and display new thumbprint Config: - Updated .gitignore to allow cert management files (docs/scripts/config) - Private keys and actual certificates still excluded (security) Context: - User asked where to manage server-side certificate - Current cert: self-signed, CN=localhost, valid 1 year - Agents validate server cert via pinning or Windows trusted roots - Critical for mTLS client cert authentication (ADR-006) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
53 lines
1.5 KiB
Bash
53 lines
1.5 KiB
Bash
#!/bin/bash
|
|
# Regenerate self-signed server certificate for ShopDB nginx
|
|
# Run this script from the repository root: bash certs/regenerate-server-cert.sh
|
|
|
|
set -e
|
|
|
|
CERT_DIR="certs"
|
|
DAYS_VALID=365
|
|
|
|
echo "=== ShopDB Server Certificate Generator ==="
|
|
echo ""
|
|
|
|
# Check if running from repo root
|
|
if [ ! -f "docker-compose.yml" ]; then
|
|
echo "ERROR: Must run from repository root"
|
|
echo "Usage: bash certs/regenerate-server-cert.sh"
|
|
exit 1
|
|
fi
|
|
|
|
# Backup old certificate
|
|
if [ -f "$CERT_DIR/server.crt" ]; then
|
|
echo "Backing up existing certificate..."
|
|
cp "$CERT_DIR/server.crt" "$CERT_DIR/server.crt.backup"
|
|
cp "$CERT_DIR/server.key" "$CERT_DIR/server.key.backup"
|
|
OLD_EXPIRY=$(openssl x509 -in "$CERT_DIR/server.crt" -noout -enddate)
|
|
echo " Old certificate: $OLD_EXPIRY"
|
|
fi
|
|
|
|
# Generate new certificate
|
|
echo ""
|
|
echo "Generating new self-signed certificate (valid $DAYS_VALID days)..."
|
|
openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout "$CERT_DIR/server.key" \
|
|
-out "$CERT_DIR/server.crt" \
|
|
-days $DAYS_VALID \
|
|
-config "$CERT_DIR/openssl.cnf" 2>/dev/null
|
|
|
|
echo ""
|
|
echo "Certificate generated successfully!"
|
|
echo ""
|
|
|
|
# Show certificate details
|
|
echo "=== Certificate Details ==="
|
|
openssl x509 -in "$CERT_DIR/server.crt" -noout -subject -dates -fingerprint -sha256
|
|
|
|
echo ""
|
|
echo "=== Next Steps ==="
|
|
echo "1. Restart nginx: docker-compose restart nginx"
|
|
echo "2. If agents use ServerCertThumbprint pinning:"
|
|
echo " - Update appsettings.json with new thumbprint (shown above)"
|
|
echo " - Restart all agents BEFORE old certificate expires"
|
|
echo ""
|