Questions regarding the life-time and config options of the default self-signed certficate

[Tronde]

Hi Team,
I would appreciated it, if someone can answer the following questions. :-)

1. Will the auto-generated self-signed certificate be renewed automatically before it expires?
2. Is it possiple to use custom certificates?
3. Where to find configuration options regarding the TLS settings and the certificate?

[frie]

No problem to replace the set of certificate files. For a public site you can use setencrypt certificates. In my private environment I also use a CA certificate (which I use to create the server certificate), which is imported in the browsers, so the OC site is accepted as secure.

[frie]

Is the question about how to create a self-signed certificate? This is well-documented at many many places...

After creating a self-signed certificate (i.e. crt and key file) I succeeded using them for OC with the following steps:

• Prepared my OC environment as described here - this is a simple bare-metal installation, not docker-based
• This one-step-install also starts the OC server a first time - I stopped it with ^C
• replaced OC_URL in the created script runopencloud.sh by the external URL of the host (must match the URL the certificated is created for!)
• replaced server.crt and server.key in data/proxy/ by the self-signed certificate files
• restarted OC by running runopencloud.sh

The OC server will not run, if the certificate files do not match with the URL. If you do not change the URL, the certificate files must be created for localhost. Probably certificate initialization is somewhere in the code (did not search for that...)

[Tronde]

Hi,
I'm currently on vacation. So sorry for my late reply.

I'm looking for answers to my initial questions and the following:

• How to turn off TLS to run OpenCloud with HTTP only behind a reverse proxy? For use cases where I need to be able to analyze the traffic between reverse proxy and OpenCloud.

I would expect to find detailed information in the documentation.

Don't get me wrong, I'm not looking for some guide to create keys and certs. I would like to know what config options exist to configure the OpenCloud container.

Cheers,
Tronde

[micbar]

There are 2 env variables in the PROXY_* namespace to set cert and key.

[Tronde]

Hi @micbar,
Do you have by chance a link handy where I can find some more information regarding this?

[micbar]

You can use two ENV variables of the proxy service.

PROXY_TRANSPORT_TLS_CERT
PROXY_TRANSPORT_TLS_KEY

Both are taking a path to a file as a value.

[Svanvith]

Will the auto-generated self-signed certificate be renewed automatically before it expires?

Yes, Traefik ACME is used.

How to turn off TLS to run OpenCloud with HTTP only behind a reverse proxy?

You need to set INSECURE=true in the .env file

[frie]

In the commented .env file (https://github.com/opencloud-eu/opencloud/blob/main/deployments/examples/opencloud_full/.env) I read

# If you're on an internet facing server, comment out following line.
# It skips certificate validation for various parts of OpenCloud and is
# needed when self signed certificates are used.
INSECURE=true

In my understanding this means that TLS still active, but a self-signed certificate is enabled

[Tronde]

From my first tests I confirm that INSECURE=true does not turn off TLS/SSL but enables self-signed certs instead.

I found this:

# do not use SSL between Traefik and OpenCloud
      PROXY_TLS: "false"

in https://github.com/opencloud-eu/opencloud/blob/main/deployments/examples/opencloud_full/opencloud.yml. I think this should switch HTTPS off.