I’m conducting an annual update of ssl certs. We generate the new certs using certbot, which has proven useful. This discussion references the implementation in RHEL 8, with apache conf in /etc/httpd.
Before implementing the new certificates, I was reviewing the ood docs, trying the recall the partnership between /etc/ood/config/ood-portal.yml and the apache ssl.conf. I believe that when generating a new /etc/httpd/conf.d/ood-portal.conf via the script
/opt/ood/ood-portal-generator/sbin/update_ood_portal, information is taken from the two source files mentioned above:
/etc/ood/config/ood-portal.yml
/etc/httpd/conf.d/ssl.conf
So, two questions for clarification:
Priority
Is configuration in the ood-portal.yml taking priority over ssl.conf when constructing ood-portal.conf?
SSL config and OOD
Are these settings associated with certbot in ssl.conf overly restrictive, or at all detrimental for operating OOD? The SSLCipherSuite is very different from what is mentioned in ood docs, and yet those materials look to me unchanged from my early implementation of ood here with v1.4 or so.
We use certbot on our ood servers. Our ssl.conf is untouched (according to rpm -qV); our generated ood-portcal.conf contains the path /etc/letsencrypt/live/… which is where certbot likes to put things.
We have an additional /etc/httpd/ssl/nessus.conf that sets a bunch of stuff (including a restricted SSL Cipher Suite) to keep our ISO group happy.
None of that affects certbot. certbot connects to your provider, and, if needed, plops a file in /etc/letsencrypt/… and runs an hhtpd reload command.
My memory on how apache handles configs is they are processed in alphabetical order.
Hi, Ric, Gerald – Ric, perhaps you could be a little more explicit. I infer that ood-portal.yml is editted at your site to point to /etc/letsencrypt/… That would be consistent with our procedure, although our certbot configuration uses the path /etc/pki/tls/acme/config/ as the base for certbot.
So, my two questions stand for clarification: priority, and certainly the advisability of using the code-block shared previously in either ssl.conf or in ood-portal.yml.
Clarifying my understanding (alternately, clarifying my confusion): /etc/httpd/conf.d/ood-portal.conf and /etc/httpd/conf.d/ssl.conf compliment each other in establishing the apache configuration. And while I don’t know the rules yet, there must be a precedence established in the case that both ood_portal.conf and ssl.conf specify SSLProtocol and/or SSLCipherSuite.
Question to OnDemand community: does OnDemand operationally “care” what the settings actually are? Do the docs that advise setting ‘SSLCertificateFile’ values mean to say the OnDemand has a requirement internally? Or is this assuming that the Apache ‘ssl.conf’ is somehow inadequate? https://osc.github.io/ood-documentation/release-2.0/installation/add-ssl.html?highlight=sslcertificatefile
And if OnDemand wants the certfile info in ondemand-portal.conf, then why not the SSLProtocol and the SSLCipherSuite?
Bottom line question: Does Apache SSL configuration belong in ood-portal.conf at all? Why should this duplicate information in ssl.conf?
The TLDR is - You need to supply SSLCertificate* configurations to OnDemand. Beyond that you can set other ssl settings globally in ssl.conf or locally to that DNS hostname in ood-portal.conf.
It’s important to note a couple things here:
certificates are specific to a DNS hostname.
apache can respond to any number of DNS hostnames (through VirtualHosts).
ood_portal.conf specifies 1 DNS hostname.
directives can be global across all VirtualHosts (a VirtualHost is configuration for a specific DNS hostname) or specific to that VirtualHost.
So putting that together we get a couple things:
you need to specify at least SSLCertificate* files for ood-portal.conf because those certificates are specific to that DNS hostname.
You could use ssl.conf to specify SSL settings globally. For example what cipers you’d accept (SSLCipherSuite). Because these settings are global (they apply to all VirtualHosts) this could be beneficiary in terms of configuration management. Since they apply across the board, you don’t have them here and there and everywhere, and potentially have mismatches.
alternatively - if you only run OnDemand through this apache, you could forget about ssl.conf and supply everything in that VirtualHost (ood-portal.conf) specifically. This may be easier to reason about, but does kind of limit you should you want to setup another website through that same apache instance.
From the apache documentation - VirtualHost settings (i.e., ood-portal.conf) override global settings. That seems reasonable as VirtualHost settings are more specific/granular than global settings.
Sections inside <VirtualHost> sections are applied after the
corresponding sections outside the virtual host definition.
This allows virtual hosts to override the main server configuration.
