In transit data security - Revision history

Adj: /* hook script for Ceph radosgw */

2026-03-07T19:07:16Z

hook script for Ceph radosgw

← Older revision		Revision as of 19:07, 7 March 2026
Line 55:		Line 55:
	** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory		** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory
	And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as documented. Well, for now. If testing shows that it does not work as documented, take some other action in the future as needed.		And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as documented. Well, for now. If testing shows that it does not work as documented, take some other action in the future as needed.

			And more sadness. Maybe even bitterness? The documentation at https://docs.ceph.com/en/squid/radosgw/frontends/ (the Squid version at least) regarding the <code>ssl_reload</code> configuration option does not actually match reality. Here's what happens when searching for the text <code>ssl_reload</code> in an unpacked Ceph 19.2.3 source tree:
			$ grep -Ril ssl_reload . 2> /dev/null
			$ du -sm . # make sure we're actually looking at an unpacked source tarball
			1270 .
			$
			Yep. It is not there. At all. It seems that perhaps the <code>ssl_reload</code> option was implemented back in the civetweb days. But it is not there. So there's a fallback plan. Send the running <code>radosgw</code> process a SIGHUP. That will reload the config, reopen logs, etc, right? Well, that does not work either. This does seem to have been recognized as a bug by upstream Ceph team. And a fix seems to be in the backports queue for both Ceph Squid (19.2.y) at https://tracker.ceph.com/issues/73704 and Tentacle (20.2.y) at https://tracker.ceph.com/issues/73703. So it might be fixed eventually. In the mean time, though, the hook script will need to restart the <code>ceph-radosgw@radosgw.''shorthostname''.service</code> unit. Sigh.

	=== hook script for Dovecot imapd ===		=== hook script for Dovecot imapd ===

Adj: /* hook script for Ceph radosgw */

2026-03-04T03:38:10Z

hook script for Ceph radosgw

← Older revision		Revision as of 03:38, 4 March 2026
Line 46:		Line 46:

	=== hook script for Ceph radosgw ===		=== hook script for Ceph radosgw ===
	~~Nothing~~ needed here. The Ceph radosgw configuration points at the Let's Encrypt live key (privkey.pem) and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.		In theory, nothing is needed here. The Ceph radosgw configuration points at the Let's Encrypt live key (privkey.pem) and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed. Unfortunately, reality is a bit more complicated. The radosgw process runs as a non-privileged <code>ceph</code> user, which is not be able to read the private key and certificate chain files in <code>/etc/letsencrypt</code>. Even worse, it starts a root, reads private key and certificate, then drops privileges.

			So, it seems a hook script will be required for this afterall. And it should do this:
	Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

	And... sadness. I'm not sure if radosgw is not trying, or trying and failing. But a certificate renewed for 90 days at 2026-05-02 21:23:01+00:00:00 (about 50 minutes before this paragraph is written) has not been picked up by the running radosgw in my test environment. And sending a SIGHUP has not changed things. I should not be surprised. So, it seems a hook script will be required for this afterall. And it should do this:
	* Exit if there were no certificates renewed		* Exit if there were no certificates renewed
	* For each domain that was renewed, check to see if it is one that we care about, and if so:		* For each domain that was renewed, check to see if it is one that we care about, and if so:

Adj: /* hook script for Ceph radosgw */

2026-03-03T18:38:44Z

hook script for Ceph radosgw

← Older revision		Revision as of 18:38, 3 March 2026
Line 56:		Line 56:
	** Make sure said directory is sufficiently private		** Make sure said directory is sufficiently private
	** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory		** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory
	And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as documented.		And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as documented. Well, for now. If testing shows that it does not work as documented, take some other action in the future as needed.

	=== hook script for Dovecot imapd ===		=== hook script for Dovecot imapd ===

Adj: /* hook script for Ceph radosgw */

2026-03-03T17:43:23Z

hook script for Ceph radosgw

← Older revision		Revision as of 17:43, 3 March 2026
Line 56:		Line 56:
	** Make sure said directory is sufficiently private		** Make sure said directory is sufficiently private
	** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory		** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory
	And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as ~~design~~.		And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as documented.

	=== hook script for Dovecot imapd ===		=== hook script for Dovecot imapd ===

Adj: /* hook script for Ceph radosgw */

2026-03-03T17:43:04Z

hook script for Ceph radosgw

← Older revision		Revision as of 17:43, 3 March 2026
Line 46:		Line 46:

	=== hook script for Ceph radosgw ===		=== hook script for Ceph radosgw ===
	Nothing needed here. The Ceph radosgw configuration points at the Let's Encrypt live key (~~prevkey~~.pem) and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.		Nothing needed here. The Ceph radosgw configuration points at the Let's Encrypt live key (privkey.pem) and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.

	Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.		Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

	And, sadness. I'm not sure if radosgw is not trying, or trying and failing. But a certificate renewed for 90 days at 2026-05-02 21:23:01+00:00:00 (about 50 minutes before this paragraph is written) has not been picked up ~~but~~ the running radosgw in my test environment. And sending a SIGHUP has not changed things.		And... sadness. I'm not sure if radosgw is not trying, or trying and failing. But a certificate renewed for 90 days at 2026-05-02 21:23:01+00:00:00 (about 50 minutes before this paragraph is written) has not been picked up by the running radosgw in my test environment. And sending a SIGHUP has not changed things. I should not be surprised. So, it seems a hook script will be required for this afterall. And it should do this:
			* Exit if there were no certificates renewed
			* For each domain that was renewed, check to see if it is one that we care about, and if so:
			** Make sure there is a directory for the RGW process to pick up its PKI files under <code>/var/lib/ceph/radosgw/''clustername''-radosgw.''shorthostname''/</code>
			** Make sure said directory is sufficiently private
			** Copy the current versions of the <code>fullchain.pem</code> and <code>privkey.pem</code> files into the PKI directory
			And just assume that the 15 minute key and certificate reload in <code>radosgw</code> works as design.

	=== hook script for Dovecot imapd ===		=== hook script for Dovecot imapd ===

Adj: /* hook script for Ceph radosgw */

2026-03-02T23:15:07Z

hook script for Ceph radosgw

← Older revision		Revision as of 23:15, 2 March 2026
Line 49:		Line 49:

	Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.		Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

			And, sadness. I'm not sure if radosgw is not trying, or trying and failing. But a certificate renewed for 90 days at 2026-05-02 21:23:01+00:00:00 (about 50 minutes before this paragraph is written) has not been picked up but the running radosgw in my test environment. And sending a SIGHUP has not changed things.

	=== hook script for Dovecot imapd ===		=== hook script for Dovecot imapd ===

Adj: /* hook script for Ceph radosgw */

2026-02-24T22:30:47Z

hook script for Ceph radosgw

← Older revision		Revision as of 22:30, 24 February 2026
Line 49:		Line 49:

	Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.		Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

			=== hook script for Dovecot imapd ===
			Very little is needed here. Dovecot child processes are started as root, so no making private key files that are readable by the less-privileged <code>dovecot</code> user. Just need to <code>systemctl reload dovecot.service</code> when a new cert and key are symlinked into the <code>/etc/letsencrypt/live/''dns_svc_domain''/</code> directory, assuming that the Dovecot config file (probably <code>/etc/dovecot/conf.d/10-ssl.conf</code>) points to the correct place.

	== certbot and/or Let's Encrypt annoyances ==		== certbot and/or Let's Encrypt annoyances ==

Adj: /* hook script for Ceph radosgw */

2026-02-01T17:01:34Z

hook script for Ceph radosgw

← Older revision		Revision as of 17:01, 1 February 2026
Line 46:		Line 46:

	=== hook script for Ceph radosgw ===		=== hook script for Ceph radosgw ===
	Nothing needed here. The Ceph radosgw configuration points at the Let's Encrypt live key and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed. Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.		Nothing needed here. The Ceph radosgw configuration points at the Let's Encrypt live key (prevkey.pem) and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.

			Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

	== certbot and/or Let's Encrypt annoyances ==		== certbot and/or Let's Encrypt annoyances ==

Adj: /* hook script for Ceph radosgw */

2026-01-27T18:36:31Z

hook script for Ceph radosgw

← Older revision		Revision as of 18:36, 27 January 2026
Line 46:		Line 46:

	=== hook script for Ceph radosgw ===		=== hook script for Ceph radosgw ===
	~~This~~ is ~~not needed~~. The Ceph radosgw configuration points at the Let's Encrypt live key and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.		Nothing needed here. The Ceph radosgw configuration points at the Let's Encrypt live key and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed. Well, hopefully. This will be tested soon. The radosgw process is supposed to run as a non-privileged <code>ceph</code> user, which may not be able to read the private key and certificate chain files.

	== certbot and/or Let's Encrypt annoyances ==		== certbot and/or Let's Encrypt annoyances ==

Adj: /* certbot installation and configuration */

2026-01-27T18:32:53Z

certbot installation and configuration

← Older revision		Revision as of 18:32, 27 January 2026
Line 34:		Line 34:

	As part of the package installation Salt state, a Let's Encrypt account is also registered by the ACME client machine, unless an account is already found.		As part of the package installation Salt state, a Let's Encrypt account is also registered by the ACME client machine, unless an account is already found.

			== Certificate enrollment ==
			This is also performed by a Salt state. If the Salt minion has the <code>letsencrypt-certificate-requestor</code> role assigned, the following happens:
			# The <code>/etc/letsencrypt/private</code> directory is created if missing and its permissions set to root, root, 0700.
			# For each domain listed in the minion's <code>letsencrypt:domains</code> pillar value:
			## A credentials file is stored under <code>/etc/letsencyrpt/private</code>. This file has the DNS TSIG secret necessary to make updates to the zone.
			## Unless certbot already knows there is a certificate for the domain, a certificate is requested using the DNS-01 ACME challenge method.

			== certbot hook scripts ==
			certbot requests certificates from Let's Encrypt. And it generates private keys, too. For TLS secured communications to happen, an endpoint needs its private key, its own ("leaf") certificate, and any intermediate certificates for certificate authorities (CAs) between the leaf and a trusted root CA. Different applications handle these in their own ways. So we may need to frobnicate the certbot PEM files or the applications' configuration to suit.

			=== hook script for Ceph radosgw ===
			This is not needed. The Ceph radosgw configuration points at the Let's Encrypt live key and leaf cert + intermediate cert (fullchain.pem) file. The radosgw configuration is set to re-load the key and certificates every 15 minutes. As such, cert renewals are handled without any additional steps needed.

	== certbot and/or Let's Encrypt annoyances ==		== certbot and/or Let's Encrypt annoyances ==