Page MenuHomePhabricator

Use Let's Encrypt certificates for the Toolforge API gateway
Closed, ResolvedPublic

Description

The public Toolforge API gateway frontend currently has self-signed certificates. In order to publicly expose that endpoint we need to have it use Lets Encrypt certificates instead. This can be done either by somehow syncing acme-chief certs to the Kubernetes cluster, or by having cert-manager issue those certificates separately.

Event Timeline

dcaro claimed this task.
dcaro subscribed.

This is done already :)

dcaro@acme$ openssl s_client -showcerts -connect api.svc.toolforge.org:443 | grep -i 'O='
Connecting to 185.15.56.11
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=R10
verify return:1
depth=0 CN=toolforge.org
verify return:1
   i:C=US, O=Let's Encrypt, CN=R10
 1 s:C=US, O=Let's Encrypt, CN=R10