ACMEv2 alt server cert for console deployments

openziti / ziti

The parent project for OpenZiti. Here you will find the executables for a fully zero trust, application embedded, programmable network @OpenZiti

https://openziti.io

Apache License 2.0

2.81k stars 159 forks source link

ACMEv2 alt server cert for console deployments #2426

Open qrkourier opened 1 month ago

qrkourier commented 1 month ago

Steps to eliminate prod controller deployment friction:

[x] include the console SPA in the openziti-controller Linux package
[x] enhance the controller config generator to enable the zac binding when some flag or var is set
[x] set zac enabled by default for the Docker controller image and Linux service bootstrapper
[ ] enhance controller bootstrapper's makePki() function to test is zac enabled and obtain and configure a trusted alt_server_certs for the combined client/mgmt API web listener

qrkourier commented 1 month ago

Deployed controllers are public so they can solve the HTTP-01 challenge to obtain and configure an alt server cert for the web binding where the console is served.