Server certificates now use a prime256v1 (P-256) EC key. The CA keeps
secp521r1. BoringSSL-based Electron clients such as MongoDB Compass
cannot use a P-521 server key.
Add a feature test that checks the CA stays on P-521 and the server
certificate uses P-256. It also checks that the server key matches its
certificate and that the CA signature verifies.
- Regenerate SSL Certificates now writes server.crt/server.key for every
engine except MongoDB, which keeps the combined server.pem. Before, the
button always wrote server.pem, so Postgres, MySQL, MariaDB, Redis, KeyDB
and Dragonfly failed to start after a regenerate.
- The certificate renewal job uses the same rule, so MongoDB no longer
switches to server.crt/server.key on renewal and fails on restart.
- Starting an SSL database writes the CA that signs its certificate to
/data/coolify/ssl/coolify-ca.crt, so a stale CA file (for example one
written by another server entry for the same host) no longer causes
"certificate signature failure".
- Saving a custom CA certificate that does not match the stored CA
private key is rejected.
- The CA file write commands live in SslHelper::caCertificateFileCommands().
Fixes#10388Fixes#6771Fixes#11926
- set default country to XX
- fix array handling of the subjectAlternativeNames so that no indexes are added or skipped
- add extendedKeyUsage to server certs to make them more secure
- add keyAgreement to server certs
- remove authorityKeyIdentifier as it caused the following issue: unable to get local issuer certificate
- removed duplicated distinguished_name entries
- improved formatting
- rename some variables for better clarity
- format subjectAltNames correctly
- setup extensions more securely and improve them a lot
- use finally block to remove tempConfig
- If SSL is disabled, delete the SSL crt and file mounts in the DB
- If SSL is disabled, delete the SSL folder
- If SSL is enabled, make sure the file mounts are added inside the helper
- remove old file mounts first to make sure the ssl crt content is always up to date and no duplicates are added
- add default state and country
- rename parameters for more clarity
- set subjectAltName
- delete old certificate before creating new one
- Set CN and subjectAltNames in DB for automatic renewal
- improve function parameters
- set default validity to 1 year as resources need to be manually restarted to use the new certificates
- use the CA cert to sign certificates
- improve security by making certificates valid for only 90 days instead of 10 years
- add SubjectAltName
- remove unnecessary parameters
- use carbon immutable to make sure expiration date stays the same
Andras Bacsai
peaklabs-dev