From 15dc0d0ede49dcfbb3b0ce04e6e0d1f25abdf28e Mon Sep 17 00:00:00 2001 From: Seunghun Lee Date: Tue, 12 Aug 2025 14:47:36 +0100 Subject: Set default external Let's Encrypt cert server Currently, unless users set either external or internal cert server by themselves, enabling Let's Encrypt with ``enable_letsencrypt`` does nothing. This change makes the external certificate get managed by Let's Encrypt by default when Let's Encrypt is enabled. The server address is default Let's Encrypt ACME server [1] which was the former default before change [2]. [1] https://acme-v02.api.letsencrypt.org/directory [2] https://review.opendev.org/c/openstack/kolla-ansible/+/925971 Closes-bug: #2120451 Change-Id: I10e800aede5966e030ed8e661e2eb45b126ff678 Signed-off-by: Seunghun Lee --- doc/source/admin/tls.rst | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) (limited to 'doc') diff --git a/doc/source/admin/tls.rst b/doc/source/admin/tls.rst index b9e779f4b..3183c45e8 100644 --- a/doc/source/admin/tls.rst +++ b/doc/source/admin/tls.rst @@ -316,19 +316,26 @@ to the HAProxy containers using SSH. with HAProxy. You can configure separate ACME servers for internal and external -certificate requests. - -.. code-block:: yaml - - letsencrypt_external_cert_server: "" - letsencrypt_internal_cert_server: "" - -.. note:: - - The ``letsencrypt_external_cert_server`` has a default value of - ``https://acme-v02.api.letsencrypt.org/directory``. Ensure that - ``letsencrypt_internal_cert_server`` is reachable from the controller - if you configure it for internal certificate requests. +certificate requests by setting server URL on +``letsencrypt_internal_cert_server`` and +``letsencrypt_external_cert_server`` respectively. +The default is external certificate ACME server set to +``https://acme-v02.api.letsencrypt.org/directory``. + +.. list-table:: Let's Encrypt management + :widths: 28 72 + :header-rows: 1 + + * - Desired outcome + - Settings + * - External only (default) + - Enable Let's Encrypt; no further changes. + * - External + internal + - Set ``letsencrypt_internal_cert_server`` and ensure it is reachable + from the controller. + * - Internal only + - Set ``letsencrypt_external_cert_server: ""`` and set + ``letsencrypt_internal_cert_server``. .. _admin-tls-generating-a-private-ca: -- cgit v1.2.3