From 85234faa0835768451afa3ff8d6629a38357a70e Mon Sep 17 00:00:00 2001 From: Mike Swierczek Date: Tue, 30 Jun 2020 13:38:40 -0400 Subject: [PATCH 1/3] Updated cron script for extracting certificates The original script to extract Sandcats certificates no longer works, per Sandstorm issue #3370. This is an attempt at a new script that appears to work properly. The new script could also be copied to a repository owned by the Sandstorm project or one of the committers, and it's trivial shell commands so I'm happy to relicense it upon request. --- docs/administering/ssl.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/administering/ssl.md b/docs/administering/ssl.md index 28b7d87e..062019f4 100644 --- a/docs/administering/ssl.md +++ b/docs/administering/ssl.md @@ -46,7 +46,9 @@ To share port 443 with other services on the same machine: web server on port 443** with Sandstorm. - You [can follow this guide](https://web.archive.org/web/20190922195059/https://juanjoalvarez.net/es/detail/2017/jan/12/how-set-sandstorm-behind-reverse-proxy-keeping-you/) - that explains how to use a [cron script](https://github.com/juanjux/sandstorm-sandcats-cert-installer) - to extract the certificates from your (sandcats.io enabled) Sandstorm installation to a location and - format where your reverse proxy can use them so it can serve Sandstorm by HTTPS, keeping your - sandcats.io domain and free auto-renewable certificates, along with any other services on your server. + that explains how to use a [cron script](https://github.com/Michael-S/sandstorm_certs_extract_cron) + to extract the certificates from your (sandcats.io enabled) Sandstorm installation. Please note that the + guide itself references an older cron script that does not work with Sandstorm versions newer than + June 2020. The extracted certificates will be a format where your reverse proxy can use them so it can + serve Sandstorm by HTTPS, keeping your sandcats.io domain and free auto-renewable certificates, along + with any other services on your server. From 6250e157f59f61ed6172a138ade603cba1e74b6e Mon Sep 17 00:00:00 2001 From: Mike Swierczek Date: Tue, 30 Jun 2020 14:27:18 -0400 Subject: [PATCH 2/3] Clarify that any certificates can be extracted My previous wording indicated that Sandcats certificates could be extracted this way, but any certificates managed by Sandstorm's ACME facility could be managed. Thanks to @ocdtrekkie for the feedback. If I still botched, that's on me. --- docs/administering/ssl.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/administering/ssl.md b/docs/administering/ssl.md index 062019f4..cf550251 100644 --- a/docs/administering/ssl.md +++ b/docs/administering/ssl.md @@ -47,8 +47,7 @@ To share port 443 with other services on the same machine: - You [can follow this guide](https://web.archive.org/web/20190922195059/https://juanjoalvarez.net/es/detail/2017/jan/12/how-set-sandstorm-behind-reverse-proxy-keeping-you/) that explains how to use a [cron script](https://github.com/Michael-S/sandstorm_certs_extract_cron) - to extract the certificates from your (sandcats.io enabled) Sandstorm installation. Please note that the + to extract the certificates from your Sandstorm-managed TLS Sandstorm installation. Please note that the guide itself references an older cron script that does not work with Sandstorm versions newer than June 2020. The extracted certificates will be a format where your reverse proxy can use them so it can - serve Sandstorm by HTTPS, keeping your sandcats.io domain and free auto-renewable certificates, along - with any other services on your server. + serve Sandstorm by HTTPS along with any other services on your server. From 1c7e36b02a03279d49295ba8b679fbdfe8aea763 Mon Sep 17 00:00:00 2001 From: Mike Swierczek Date: Wed, 1 Jul 2020 21:28:08 -0400 Subject: [PATCH 3/3] Updated cron script for extracting certificates Adjusted wording based on feedback from zenhack and ocdtrekkie. --- docs/administering/ssl.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/administering/ssl.md b/docs/administering/ssl.md index cf550251..5b1629b3 100644 --- a/docs/administering/ssl.md +++ b/docs/administering/ssl.md @@ -44,10 +44,11 @@ To share port 443 with other services on the same machine: - You [can install `sniproxy` to share port 443](sniproxy.md) between your existing server and Sandstorm so that Sandstorm can manage (and autorenew) its own certificates. This allows you to combine an **existing web server on port 443** with Sandstorm. - + - You [can follow this guide](https://web.archive.org/web/20190922195059/https://juanjoalvarez.net/es/detail/2017/jan/12/how-set-sandstorm-behind-reverse-proxy-keeping-you/) - that explains how to use a [cron script](https://github.com/Michael-S/sandstorm_certs_extract_cron) - to extract the certificates from your Sandstorm-managed TLS Sandstorm installation. Please note that the - guide itself references an older cron script that does not work with Sandstorm versions newer than - June 2020. The extracted certificates will be a format where your reverse proxy can use them so it can - serve Sandstorm by HTTPS along with any other services on your server. + that explains how to use a cron script to extract the certificates from your installation with + Sandstorm-managed TLS. Please note that the guide itself references an older cron script that + does not work with Sandstorm versions newer than June 2020, but there is an updated script + [here](https://github.com/Michael-S/sandstorm_certs_extract_cron). The extracted certificates + will be formatted so your reverse proxy can use them to serve Sandstorm by HTTPS + along with any other services on your server.