Skip to content

feat: add support for selecting SSL key type (ECDSA/RSA) #4218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 30 commits into
base: develop
Choose a base branch
from
Open

feat: add support for selecting SSL key type (ECDSA/RSA) #4218

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
e6ec74c
feat: add support for selecting SSL key type (ECDSA/RSA)
mnr73 Dec 9, 2024
8e9e033
fix indent: tab to space
mnr73 Dec 9, 2024
891877a
fix ssl key-type certificate
mnr73 Dec 11, 2024
2723de2
add ssl_ecdh_curve for more compatibility
mnr73 Dec 11, 2024
5e7b69c
add update cipher suites
mnr73 Dec 11, 2024
95a94a4
add elliptic-curve
mnr73 Dec 11, 2024
111fc28
Revert "add elliptic-curve"
mnr73 Dec 11, 2024
04b3608
remove elliptic-curve from certbot command options
mnr73 Dec 11, 2024
cb79556
add ssl_key_type in swagger
mnr73 Dec 12, 2024
eb5c51a
add support more cipher suites
mnr73 Dec 12, 2024
2e45444
change ssl_ciphers for more compatibility
mnr73 Dec 12, 2024
5ba7363
fix ssl cipher bug
mnr73 Dec 13, 2024
f386f6b
remove elliptic-curve
mnr73 Dec 13, 2024
32e0784
support more cipher suites
mnr73 Dec 21, 2024
f68c1b7
add Diffie-Hellman Parameters to cipher suites
mnr73 Dec 21, 2024
1353937
fix copy address
mnr73 Dec 21, 2024
04636b7
add feature: set default server
mnr73 Dec 21, 2024
5dc78df
fix messages indent: convert to space
mnr73 Dec 22, 2024
c6d884d
fix indent
mnr73 Dec 22, 2024
ad36fb5
show select ssl key type just for create new ssl
mnr73 Jan 1, 2025
65f971f
add migration names and combine ssl key migrations
mnr73 Jan 1, 2025
a121cb1
remove unnecessary whitespace
mnr73 Jan 1, 2025
d3a5fac
make ssl_key_type optional
mnr73 Jan 1, 2025
2cab405
Merge branch 'fix-bugs' into develop
mnr73 Jan 1, 2025
101afa0
remove default_server from certificate object
mnr73 Jan 3, 2025
408eab8
remove unesessary default values
mnr73 Jan 4, 2025
c135880
Revert "remove default_server from certificate object"
mnr73 Jan 4, 2025
f34cb59
Revert "remove unesessary default values"
mnr73 Jan 4, 2025
3856b6b
remove default server from certificate object
mnr73 Jan 8, 2025
08f95a9
Merge remote-tracking branch 'upstream/develop' into develop
mnr73 Feb 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add Diffie-Hellman Parameters to cipher suites
  • Loading branch information
@mnr73
mnr73 committed Dec 21, 2024
commit f68c1b7c29afc8ef013bb072b7614a1ce07bee9f
4 changes: 3 additions & 1 deletion docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,11 @@ COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager
# Remove frontend service not required for prod, dev nginx config as well
RUN rm -rf /etc/s6-overlay/s6-rc.d/user/contents.d/frontend /etc/nginx/conf.d/dev.conf \
&& chmod 644 /etc/logrotate.d/nginx-proxy-manager
COPY start-container /usr/local/bin/start-container
RUN chmod +x /usr/local/bin/start-container

VOLUME [ "/data" ]
ENTRYPOINT [ "/init" ]
ENTRYPOINT [ "start-container" ]

LABEL org.label-schema.schema-version="1.0" \
org.label-schema.license="MIT" \
Expand Down
5 changes: 4 additions & 1 deletion docker/dev/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,5 +35,8 @@ RUN rm -f /etc/nginx/conf.d/production.conf \
COPY --from=pebbleca /test/certs/pebble.minica.pem /etc/ssl/certs/pebble.minica.pem
COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt

COPY start-container /usr/local/bin/start-container
RUN chmod +x /usr/local/bin/start-container

EXPOSE 80 81 443
ENTRYPOINT [ "/init" ]
ENTRYPOINT [ "start-container" ]
1 change: 1 addition & 0 deletions docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,4 @@ ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers "ALL:RC4-SHA:AES128-SHA:AES256-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384:AES128-GCM-SHA256:RSA-AES256-CBC-SHA:RC4-MD5:DES-CBC3-SHA:AES256-SHA:RC4-SHA:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
ssl_prefer_server_ciphers off;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
13 changes: 13 additions & 0 deletions docker/start-container
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/usr/bin/env bash
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be achieved using the S6 init scripts instead of adding another layer of initialization. However this might not be required here at all...

Can this file /etc/ssl/certs/dhparam.pem be generated at build time instead of run time?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if generate this file in build time. it's be same for all user that use this and i think this is a security problem.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok maybe, but why would it be different for all users when they are all using the same docker image?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The DH parameter file is used for secure key exchange, and having the same file for all users can compromise security. It’s recommended to generate a unique file per instance to ensure the security of each user’s connection.


FILE="/etc/ssl/certs/dhparam.pem"

if [ ! -f "$FILE" ]; then
echo "the $FILE does not exist, creating..."
openssl dhparam -out "$FILE" 2048
else
echo "the $FILE already exists, skipping..."
fi

echo "run default script"
exec /init