Consul K/V certstore and wildcard certificates #621
Comments
|
Fabio takes certificates in a combined PEM format. With consul the path you specify is interpreted as a prefix. In your example it's expected that you would have a structure similar to this in your Consul KV store: In each of those keys you should have a concatenated combined pem ... if That make sense? With LetsEncrypt it would be the |
|
@leprechau Hi Aaron, thanks for getting back to me. That does make sense, does Fabio read the domains from the certificates and use the correct one automatically based on the request, or do I need to name my keys accordingly? |
|
The KV and/or file name isn't important. Fabio will pick the most specific matching CN of the available certificates. |
|
@leprechau That is good to know, that sounds almost magical :) I am having some issues and the log-file isn't helping me so much. My service is tagged with: I've installed the
And I am using the default Fabio configuration, only thing changed is the However, the log doesn't show anything related to the
Here is the full fabio log: Am I missing something obvious? |
|
You'll need the |
|
Hi, just a hunch but wildcard certs I have seen are usually Would it possible to verify the cert and key first using a tls web server like |
|
@shantanugadgil Thanks for your suggestion. I did have some issues with the wildcard certs, so I've decided to just use full domains and skip the wildcard certs for now, it is more important to get some https working than get wildcards working :) I will take a look at gowebhello when I toy with wildcard certs again. Edit: These are the domains in my certificate:
|
|
@leprechau I see, I didn't read what you wrote, I have now done the I noticed this from the logs: Does that look right? It look like Fabio is doing a https connection to my service, I thought Fabio would serve the cert and do http internally. |
|
Ohh, okay ... so fabio can do HTTPs termination for you on the front ... and it can also do HTTPs termination to backend services. The I think what you are wanting is for fabio to handle all HTTPs termination and then use plain HTTP to the backend? If that's the case you simply need to configure the https://fabiolb.net/ref/proxy.addr/ You can also have fabio automatically redirect HTTP to HTTPS using a redirect. https://fabiolb.net/feature/http-redirects/ Hope that helps! |
|
Here's an example configuration from our development environment where we have several listeners defined: The above config creates one certificate store as a file base where I have the concatenated certs in Requests inbound on port 80 will be standard HTTP ... requests on port 443 fabio will terminate TLS and us the configured certificate store to find a certificate matching the SNI of the request. To force HTTPS we place the following in the consul KV config: |
|
@leprechau Thank you so much for your patience and examples, very handy to know about the I've now done the changes you recommended, so my config is now like this: And now Fabio also picks up the configuration on boot: However, when I visit any of the sites the log shows this: It turned out that the key had to be named |
Hi,
I am a little bit confused about how the SSL-certs works with Consul, I have the following domains
and
If I run Fabio like this:
And then configure my services with the following tags:
and:
Should the pem/key be placed at
ssl-certificates/billett.ooo.pemandssl-certificates/billett.ooo.key? And should I also have a cert likessl-certificates/www.billett.ooo.pemeven though it is the same cert for both www and non-www?And how would I install and configure the wildcard certificate?
The text was updated successfully, but these errors were encountered: