diff --git a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb index e1a17ef4c1d37f5ecfbc2cbee5b4c1e9d7c30903_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI=..715e27bc7a08791845d9f7c2b951aa64f79b85ea_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9yZXNvdXJjZXMvY2VydGlmaWNhdGUucmI= 100644 --- a/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb +++ b/files/gitlab-cookbooks/letsencrypt/resources/certificate.rb @@ -22,6 +22,21 @@ # they provide invalid data helper = LetsEncryptHelper.new(node) contact_info = helper.contact + target_key_size = new_resource.key_size || node['acme']['key_size'] + + if ::File.file?("#{new_resource.key}-staging") + staging_key = OpenSSL::PKey::RSA.new ::File.read "#{new_resource.key}-staging" + staging_key_size = staging_key.n.num_bits + + if staging_key_size != target_key_size + file "#{new_resource.key}-staging" do + action :delete + end + file "#{new_resource.crt}-staging" do + action :delete + end + end + end acme_certificate 'staging' do alt_names new_resource.alt_names unless new_resource.alt_names.empty? @@ -44,6 +59,20 @@ end end + if ::File.file?(new_resource.key) + production_key = OpenSSL::PKey::RSA.new ::File.read new_resource.key + production_key_size = production_key.n.num_bits + + if production_key_size != target_key_size + file new_resource.key do + action :delete + end + file new_resource.crt do + action :delete + end + end + end + acme_certificate 'production' do alt_names new_resource.alt_names unless new_resource.alt_names.empty? key_size new_resource.key_size unless new_resource.key_size.nil? diff --git a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb index e1a17ef4c1d37f5ecfbc2cbee5b4c1e9d7c30903_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi..715e27bc7a08791845d9f7c2b951aa64f79b85ea_c3BlYy9jaGVmL2xldHNlbmNyeXB0L3Jlc291cmNlcy9sZXRzZW5jcnlwdF9jZXJ0aWZpY2F0ZV9zcGVjLnJi 100644 --- a/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb +++ b/spec/chef/letsencrypt/resources/letsencrypt_certificate_spec.rb @@ -44,6 +44,36 @@ ) end + context 'specifying a different key_size' do + before do + allow(File).to receive(:file?).and_call_original + allow(File).to receive(:file?).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(true) + allow(File).to receive(:read).with(anything).and_call_original + allow(File).to receive(:read).with('/etc/gitlab/ssl/fakehost.example.com.key').and_return(OpenSSL::PKey::RSA.new(2048)) + + stub_gitlab_rb( + external_url: 'https://fakehost.example.com', + letsencrypt: { + enable: true, + key_size: 3072 + } + ) + end + + it 'deletes and recreates the SSL files' do + expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.key') + expect(chef_run).to delete_file('/etc/gitlab/ssl/fakehost.example.com.crt') + + expect(chef_run).to create_acme_certificate('production').with( + crt: '/etc/gitlab/ssl/fakehost.example.com.crt', + key: '/etc/gitlab/ssl/fakehost.example.com.key', + key_size: 3072, + wwwroot: '/var/opt/gitlab/nginx/www', + sensitive: true + ) + end + end + it 'reloads nginx' do prod_cert = chef_run.acme_certificate('production') expect(prod_cert).to notify('execute[reload nginx]').to(:run) @@ -72,6 +102,11 @@ end context 'when NGINX is not running' do + before do + allow_any_instance_of(OmnibusHelper).to receive(:service_up?).and_return(false) + allow_any_instance_of(OmnibusHelper).to receive(:service_up?).with('nginx').and_return(false) + end + it 'does not attempt to create a certificate' do expect(chef_run).not_to create_acme_certificate('staging') expect(chef_run).not_to create_acme_certificate('production') diff --git a/spec/fixtures/cookbooks/acme/attributes/default.rb b/spec/fixtures/cookbooks/acme/attributes/default.rb new file mode 100644 index 0000000000000000000000000000000000000000..715e27bc7a08791845d9f7c2b951aa64f79b85ea_c3BlYy9maXh0dXJlcy9jb29rYm9va3MvYWNtZS9hdHRyaWJ1dGVzL2RlZmF1bHQucmI= --- /dev/null +++ b/spec/fixtures/cookbooks/acme/attributes/default.rb @@ -0,0 +1,1 @@ +default['acme']['key_size'] = 2048