web-based cert management in Debian?

2012-04-08 Thread Daniel Pocock
Hi, I was just looking at package ssl-cert I'm packaging a SIP proxy that would benefit from SSL certs Has there been any discussion about doing something more than ssl-cert, e.g. a simple web interface to invoke `openssl req', let the admin cut-and-paste the req to their CA without ever

Re: web-based cert management in Debian?

2013-04-10 Thread Daniel Pocock
On 08/04/12 22:03, Stefan Fritsch wrote: Hi Daniel, On Sunday 08 April 2012, Daniel Pocock wrote: I was just looking at package ssl-cert I'm packaging a SIP proxy that would benefit from SSL certs Has there been any discussion about doing something more than ssl-cert, e.g. a simple web

Bug#740162: mod_authnz_ldap: no error.log feedback about LDAP TLS issues such as cert expiry, cipher mismatch, etc

2014-02-26 Thread Daniel Pocock
Package: apache2.2-bin Version: 2.2.22-13+deb7u1 Apache is authenticating users against an LDAP server. An ldaps:// URL is used, e.g. AuthLDAPURL ldaps://ldap.example.org/dc=example,dc=org When the LDAP server SSL cert expires, access to the protected URLs fails with 500 Internal Server Error

Bug#741350: a2enconf confusion - .conf extension?

2014-03-11 Thread Daniel Pocock
Package: apache2 My package fails piuparts with Apache 2.4: https://piuparts.debian.org/sid/fail/loganalyzer_3.6.5+dfsg-2.log Looking at that log, I notice: Setting up loganalyzer (3.6.5+dfsg-2) ... Module php5 already enabled Enabling module cgi. To activate the new configuration,

Bug#741350: a2enconf confusion - .conf extension?

2014-03-14 Thread Daniel Pocock
On 11/03/14 18:17, Jean-Michel Vourgère wrote: Hello Daniel Please read apache2 debian news ( /usr/share/doc/apache2/NEWS.Debian.gz ) Moreover, the configuration mechanism in Debian has changed. All configurations in sites-enabled and conf-enabled need a .conf suffix now. This mechanism

Bug#741350: a2enconf confusion - .conf extension?

2014-03-15 Thread Daniel Pocock
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 14/03/14 18:53, Jean-Michel Vourgère wrote: Hello Daniel Just a few hints: On Friday 14 March 2014 08:35:55 Daniel Pocock wrote: a) if my postinst or postrm calls apache2_invoke from inside a function, then it fails badly b) some

Bug#758513: fails to authenticate if multiple LDAP results match, misleading error message

2014-10-05 Thread Daniel Pocock
On 05/10/14 18:56, Stefan Fritsch wrote: On Sunday 05 October 2014 12:04:12, Daniel Pocock wrote: The bug report is not for the behavior (I agree it makes sense to deny the login), it is a problem with the error message. The error message says user daniel not found

Bug#790943: Root and local certificate location clash

2015-07-03 Thread Daniel Pocock
Package: ssl-cert Version: 1.0.35 Severity: serious I've marked this bug serious because it could lead to security problems if people mix root certs and other certs in the same directory This package provides the script /usr/sbin/make-ssl-cert It creates certificates and puts the public key /

Bug#790943: server certificates/key pairs and CA directories

2015-08-02 Thread Daniel Pocock
On 21/07/15 18:50, Thorsten Glaser wrote: Daniel Pocock daniel at pocock.pro writes: I looked at the package ssl-cert to try and understand and there I found that it is using /etc/ssl/certs for server certs while other packages Do NOT do that. I wasn't suggesting that was desirable

Bug#790943: server certificates/key pairs and CA directories

2015-08-02 Thread Daniel Pocock
On 2 August 2015 11:25:35 CEST, Paul Wise p...@debian.org wrote: On Sun, Aug 2, 2015 at 4:50 PM, Daniel Pocock wrote: Does anybody know which packages create or use the /etc/ssl/ssl.* That looks like a sysadmin created path, only one package even mentions it: https://codesearch.debian.net

Bug#816904: future of make-ssl-cert now that we have letsencrypt

2016-03-06 Thread Daniel Pocock
Package: ssl-cert Version: 1.0.35 Severity: wishlist Should the make-ssl-cert script continue doing the same thing, creating Snakeoil certs only? Or should it be extended to give the user the option of using letsencrypt? If this is added, any packages already relying on make-ssl-cert will