The Wayback Machine - https://web.archive.org/web/20200907055408/https://github.com/apache/apisix/issues/2110
Skip to content

/ apisix

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

request help: move `conf/cert` to `t/cert` #2110

Open
moonming opened this issue Aug 24, 2020 · 8 comments · May be fixed by #2112
Open

request help: move `conf/cert` to `t/cert` #2110

moonming opened this issue Aug 24, 2020 · 8 comments · May be fixed by #2112
Labels
good first issue help wanted

Comments

@moonming
Copy link
Member

@moonming moonming commented Aug 24, 2020

all of these files are ONLY for test cases.
@Yiyiyimu
Copy link
Contributor

@Yiyiyimu Yiyiyimu commented Aug 24, 2020

Do we also need to change the path in Makefile?

apisix/Makefile

Line 124 in 1aefe91

$(INSTALL) conf/cert/apisix.* /usr/local/apisix/conf/cert/

@moonming
Copy link
Member Author

@moonming moonming commented Aug 24, 2020

Do we also need to change the path in Makefile?

apisix/Makefile

Line 124 in 1aefe91

$(INSTALL) conf/cert/apisix.* /usr/local/apisix/conf/cert/

we shoule remove this line :)
@Yiyiyimu Yiyiyimu linked a pull request that will close this issue Aug 24, 2020
Open
2 of 4 tasks complete
@Yiyiyimu
Copy link
Contributor

@Yiyiyimu Yiyiyimu commented Aug 24, 2020

we shoule remove this line :)

Sure thx
@Yiyiyimu
Copy link
Contributor

@Yiyiyimu Yiyiyimu commented Aug 24, 2020 •
edited

apisix/bin/apisix

Lines 289 to 303 in 1aefe91

{%if https_admin then%}
listen {* port_admin *} ssl;
{%if admin_api_mtls and admin_api_mtls.admin_ssl_cert and admin_api_mtls.admin_ssl_cert ~= "" and
admin_api_mtls.admin_ssl_cert_key and admin_api_mtls.admin_ssl_cert_key ~= "" and
admin_api_mtls.admin_ssl_ca_cert and admin_api_mtls.admin_ssl_ca_cert ~= ""
then%}
ssl_verify_client on;
ssl_certificate {* admin_api_mtls.admin_ssl_cert *};
ssl_certificate_key {* admin_api_mtls.admin_ssl_cert_key *};
ssl_client_certificate {* admin_api_mtls.admin_ssl_ca_cert *};
{% else %}
ssl_certificate cert/apisix_admin_ssl.crt;
ssl_certificate_key cert/apisix_admin_ssl.key;
{%end%}

apisix/bin/apisix

Lines 366 to 367 in 1aefe91

ssl_certificate cert/apisix.crt;
ssl_certificate_key cert/apisix.key;

It seems need to configure ssl_certificate when start apisix
@moonming
Copy link
Member Author

@moonming moonming commented Aug 24, 2020

the default of https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L64 is empty, so I think we can also remove

apisix/bin/apisix

Lines 366 to 367 in 1aefe91

ssl_certificate cert/apisix.crt;
ssl_certificate_key cert/apisix.key;
.
@nic-chen what do you think?
@nic-chen
Copy link
Member

@nic-chen nic-chen commented Aug 24, 2020

the default of https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L64 is empty, so I think we can also remove

apisix/bin/apisix

Lines 366 to 367 in 1aefe91

ssl_certificate cert/apisix.crt;
ssl_certificate_key cert/apisix.key;

.
@nic-chen what do you think?

sure, i think it's better empty default.
@Yiyiyimu
Copy link
Contributor

@Yiyiyimu Yiyiyimu commented Aug 24, 2020 •
edited

the default of https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L64 is empty, so I think we can also remove

apisix/bin/apisix

Lines 366 to 367 in 1aefe91

ssl_certificate cert/apisix.crt;
ssl_certificate_key cert/apisix.key;

.
@nic-chen what do you think?

@moonming But when the default is set to empty, apisix would choose to use cert&key in conf/cert

apisix/bin/apisix

Lines 289 to 303 in 1aefe91

{%if https_admin then%}
listen {* port_admin *} ssl;
{%if admin_api_mtls and admin_api_mtls.admin_ssl_cert and admin_api_mtls.admin_ssl_cert ~= "" and
admin_api_mtls.admin_ssl_cert_key and admin_api_mtls.admin_ssl_cert_key ~= "" and
admin_api_mtls.admin_ssl_ca_cert and admin_api_mtls.admin_ssl_ca_cert ~= ""
then%}
ssl_verify_client on;
ssl_certificate {* admin_api_mtls.admin_ssl_cert *};
ssl_certificate_key {* admin_api_mtls.admin_ssl_cert_key *};
ssl_client_certificate {* admin_api_mtls.admin_ssl_ca_cert *};
{% else %}
ssl_certificate cert/apisix_admin_ssl.crt;
ssl_certificate_key cert/apisix_admin_ssl.key;
{%end%}

@Yiyiyimu
Copy link
Contributor

@Yiyiyimu Yiyiyimu commented Sep 5, 2020

Hi @moonming @nic-chen any suggestions?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue help wanted
3 participants
@moonming @nic-chen @Yiyiyimu
You can’t perform that action at this time.