48 lines
1.7 KiB
Bash
48 lines
1.7 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Generate a self-signed cert for prometheus.x and print its DER sha256.
|
||
|
|
#
|
||
|
|
# The sha256 is what you register as the `tls` record on chain for the name.
|
||
|
|
# Theseus and Ariadne refuse any certificate whose DER sha256 does not match
|
||
|
|
# that value, which is the whole point of the pinning model.
|
||
|
|
#
|
||
|
|
# Run on the VPS. Writes to /etc/ssl/prometheus-x/, so sudo.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# sudo bash deploy/make-tls-cert.sh
|
||
|
|
# -> prints: tls fingerprint: 9671bd5f44047f74203a76439430bda7bcf7c36d913c0fbd4cc75e24e374dde3
|
||
|
|
#
|
||
|
|
# To rotate: run again; it overwrites the files and prints the new fingerprint.
|
||
|
|
# Then: node Argus/src/register.js prometheus.x '{"ip":"<ip>","tls":"<new fp>"}'
|
||
|
|
# After the record TX confirms (~5 min on chipnet, longer on mainnet), the
|
||
|
|
# clients see the new cert.
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
DIR=/etc/ssl/prometheus-x
|
||
|
|
mkdir -p "$DIR"
|
||
|
|
|
||
|
|
# ECDSA P-256 — small and fast. 10-year expiry; the on-chain pin, not the cert
|
||
|
|
# metadata, is what expires. SAN includes both the BNS name and the "localhost"
|
||
|
|
# proxy destination so a sanity-check curl against the vhost works.
|
||
|
|
openssl req \
|
||
|
|
-x509 -nodes \
|
||
|
|
-newkey ec \
|
||
|
|
-pkeyopt ec_paramgen_curve:P-256 \
|
||
|
|
-keyout "$DIR/privkey.pem" \
|
||
|
|
-out "$DIR/fullchain.pem" \
|
||
|
|
-days 3650 \
|
||
|
|
-subj "/CN=prometheus.x" \
|
||
|
|
-addext "subjectAltName=DNS:prometheus.x,DNS:localhost" \
|
||
|
|
2>/dev/null
|
||
|
|
|
||
|
|
chmod 600 "$DIR/privkey.pem"
|
||
|
|
chmod 644 "$DIR/fullchain.pem"
|
||
|
|
|
||
|
|
FP=$(openssl x509 -in "$DIR/fullchain.pem" -outform DER | openssl dgst -sha256 | awk '{print $NF}')
|
||
|
|
|
||
|
|
echo "cert path: $DIR/fullchain.pem"
|
||
|
|
echo "key path: $DIR/privkey.pem"
|
||
|
|
echo "tls fingerprint: $FP"
|
||
|
|
echo
|
||
|
|
echo "Register with: node Argus/src/register.js prometheus.x '{\"ip\":\"<ip>\",\"tls\":\"$FP\"}'"
|