Code Monkey home page Code Monkey logo

certbot-bigip's Introduction

certbot-bigip

Requirements

see certbot rquirements: https://certbot.eff.org/docs/install.html#system-requirements

  • F5
    • The LetsEncrypt Chain needs to be at /Common/chain_Letsencrypt and in every other partition that uses this plugin. ( f.e.: /Partition/chain_Letsencrypt) At the moment, the plugin checks if a corresponding certificate/chain is located in the same partition/folder as the clientssl profile that uses it.
    • clientssl profile needs to be attached to the virtual server manually(DOMAIN_clientssl). At the moment, the plugin only updates the client profile but does not attach it to the virtual server.
    • F5 SW version 14.x and higher

Install

pip install certbot-bigip

by installing the plugin you will also install all missing dependencies including certbot.

Supported Features

  • verifies the domain via HTTP01 (challenge verification implemented through an iRule)
  • Partitions and iApps
  • Standalone and HA setups (Active/Standby, Active/Active)
  • Creates the clientssl profile and attaches the certificate, key and chain
    • Does not modify the clientssl profile if it already exists
  • Supports APM enabled virtual servers

Usage

Parameters:
  --bigip-list                CSV list of BIG-IP system  hostnames or addresses, all have to be in the same cluster
  --bigip-username            BIG-IP username (common to all listed BIG-IP systems)
  --bigip-password            BIG-IP password (common to all listed BIG-IP systems)
  --bigip-partition           BIG-IP partition (common to all listed BIG-IP systems)
  --bigip-clientssl-parent    Client SSL parent profile to inherit default values from
  --bigip-vs-list             CSV list of BIG-IP virtual server names, optionally including partition
  --bigip-device-group        Device Group to syncronise configuration
  --bigip-iapp                BIG-IP iApp (common to all listed BIG-IP systems)
  --bigip-apm                 Is the VS APM enabled or not

Example:

certbot --non-interactive --expand --email '[email protected]' --agree-tos \
  -a bigip -i bigip \
  -d 'example.com' \
  --bigip-list 'example-f5.local,example-f5-ha.local' \
  --bigip-username 'user' \
  --bigip-password 'secret' \
  --bigip-partition 'internal' \
  --bigip-clientssl-parent '/Common/parent_clientssl' \
  --bigip-vs-list '/internal/example.com.app/example.com_vs' \
  --bigip-device-group 'fail-sync' \
  --bigip-iapp '/internal/example.com.app/example.com'

If the installation of a certificate during a certbot renew command somehow fails, certbot will not try to install the new certificate on a later run. You can implement a check if the local certificate matches the remote certificate and if not issue a certbot install --cert-name example.com command.

certbot renew 

if ! /usr/local/bin/cert-test.sh --quiet example.com
then
  echo $(date)
  echo "installing example.com"
  certbot install --cert-name'example.com' 
fi

Alternatevly you can split the commands and not use the renew functionality like this:

certbot certonly --non-interactive --expand --email '[email protected]' --agree-tos \
  -a bigip -i bigip \
  -d 'example.com' \
  --bigip-list 'example-f5.local,example-f5-ha.local' \
  --bigip-username 'user' \
  --bigip-password 'secret' \
  --bigip-partition 'internal' \
  --bigip-clientssl-parent '/Common/parent_clientssl' \
  --bigip-vs-list '/internal/example.com.app/example.com_vs' \
  --bigip-device-group 'fail-sync' \
  --bigip-iapp '/internal/example.com.app/example.com_vs'

if ! /usr/local/bin/cert-test.sh --quiet example.com
then
  echo $(date)
  echo "installing example.com"
  certbot --non-interactive --expand --email '[email protected]' --agree-tos \
    -a bigip -i bigip \
    -d 'example.com' \
    --bigip-list 'example-f5.local,example-f5-ha.local' \
    --bigip-username 'user' \
    --bigip-password 'secret' \
    --bigip-partition 'internal' \
    --bigip-clientssl-parent '/Common/parent_clientssl' \
    --bigip-vs-list '/internal/example.com.app/example.com_vs' \
    --bigip-device-group 'fail-sync' \
    --bigip-iapp '/internal/example.com.app/example.com_vs'
else
  echo $(date)
  echo "not installing example.com"
fi

The first call only validates and renews the certificate through certonly parameter and the cert-test.sh compares the local certificate to the certificate delivered by the F5. If these don't match the second certbot call will skip the validation (as the certificate got already renewed) and install the certificate onto the F5.

Testing

⚠️ Currently only integration tests are supported. Therefore a bigip is needed. To run integrations tests with other plugins for example the bluecat plugin you also need a bluecat in place.

Prerequisites

  1. Connection to the bigip under test from the machine running the tests
  2. clientssl profile needs to be attached to the virtual server manually(DOMAIN_clientssl). At the moment, the plugin only updates the client profile but does not attach it to the virtual server.
  3. Configure the tests using the following environment variables:
ENV default Example
BIGIP_EMAIL [email protected]
BIGIP_USERNAME user
BIGIP_PASSWORD secret
BIGIP_LIST example-f5.local,example-f5-ha.local
BIGIP_PARTITION internal
BIGIP_CLIENTSSL_PARENT /Common/parent_clientssl
BIGIP_VS_LIST /internal/example.com.app/example.com_vs
BIGIP_DEVICE_GROUP fail-sync fail-sync
BIGIP_IAPP /internal/example.com.app/example.com
BIGIP_CUSTOM_PARTITION Common Common
BIGIP_CUSTOM_VS_LIST /Common/example.com.app/example1.com_vs, /Common/example.com.app/example2.com_vs

running the tests

python setup.py test

Contributing

If you find errors please open a new issue.

Open a pull request if you have made changes you want to add. we will take a look at it and try our best to merge it. Your help is very welcomed.

certbot-bigip's People

Contributors

emalzer avatar flokain avatar

Stargazers

avatar avatar

Watchers

avatar avatar avatar avatar

Forkers

natewerner

certbot-bigip's Issues

upload SAN cert only once

When multiple names are requested, the script installs each as it's own cert even though Let's Encrypt only issued one SAN (Subject Alt Name) cert.

request a cert with something like -d example.com -d *.example.com (I'm using -a dns-rfc2136 for wildcards)

Expected behavior
One cert should be uploaded named after the first host pattern. There should only be one. Instead of this:

  • example_com_Letsencrypt
  • wildcard_example_com_Letsencrypt

release on pypi

Is your feature request related to a problem? Please describe.
autmatically release on pypi when test pass at on

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
snippet from old pipline

compile package:
  <<: *base_job
  stage: build
  script:
    - python setup.py sdist
  only:
    - tags
  except:
    - branches
  artifacts:
    name: "$CI_JOB_NAME"
    paths:
      - dist/
    expire_in: 10 mins

release on pypi:
  <<: *base_job
  image: python:3
  stage: release
  script:
    - pip install -U twine
    - twine upload dist/*
  only:
    - tags
  except:
    - branches

wait for ON integration tests in pipeline

make a test stage in github actions
trigger the remote opennetwork integration pipeline and poll for the result.

pull request shall onlz be merged if the remote pipeline succeeds

do not require VS when only using installer

Is your feature request related to a problem? Please describe.
When using only the installer portion of this plugin, it should not require a vs-list as it's not used during install.

Describe the solution you'd like
when using -a dns-rfc2136 and -i bigip I get the error:
--bigip-vs-list is required when using the F5 BIG-IP plugin

Describe alternatives you've considered
I'm using dns-rfc-2136 to request wildcard certificates.
I want to use this plugin to install them on multiple F5s that are in different groups.

Additional context
The F5s are in different datacenters and DNS load balanced between them.
The names of the virtual servers are different in each group.

Add options to set certificate/key name suffix and CA chain name

Please add an option to define the certificate and private key suffix. I am using a certificate authority that is not Let's Encrypt. Adding "_letsencrypt" to the certificate names in our case can cause confusion.

Please add an option to define the name of the CA chain. Again, because using a different CA can cause confusion.

Add instructions for snap installation of certbot

Is your feature request related to a problem? Please describe.
Currently, the only fully supported method to install certbot is as a snap. The current instructions seem to assume a pip-based installation.

Describe the solution you'd like
Can you document how to install the plugin with a snap-based installation and get certbot to find the installation and all dependencies?

Describe alternatives you've considered
Alternately, and probably better, change the plugin to a snap. https://eff-certbot.readthedocs.io/en/stable/contributing.html#dev-plugin

Additional context

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.