From 5581a282539b406977dcc6d1577ac2a51d46e4cf Mon Sep 17 00:00:00 2001 From: James Kirsch Date: Thu, 16 Apr 2020 16:10:46 -0500 Subject: Add support for LetsEncrypt-managed certs Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106 --- doc/source/admin/tls.rst | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'doc/source/admin') diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst index f2acb9bb3..2810ecdc8 100644 --- a/doc/source/admin/tls.rst +++ b/doc/source/admin/tls.rst @@ -288,6 +288,35 @@ disable verification of the backend certificate: .. _admin-tls-generating-a-private-ca: +Generating TLS certificates with Let's Encrypt +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Let's Encrypt is a free, automated, and open certificate authority. + +To enable OpenStack to deploy the Let's Encrypt container to fetch +certificates from the Let's Encrypt certificate authority, the following +must be configured in ``globals.yml``: + +.. code-block:: yaml + + enable_letsencrypt: "yes" + letsencrypt_email: "" + +The Let's Encrypt container will attempt to renew your certificates every 12 +hours. If the certificates are renewed, they will automatically be deployed +to the HAProxy containers using SSH. + +.. note:: + + If ``letsencrypt_email`` is not valid email, letsencrypt role will + not work correctly. + +.. note:: + + If ``enable_letsencrypt`` is set to true, haproxy's socket will run with + admin access level. This is needed so Let's Encrypt can interact + with HAProxy. + Generating a Private Certificate Authority ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- cgit v1.2.3