setup scripts and Let's Encrypt

[Dave S]

Looking at the centos7 setup script, I see it generates a self-signed certificate.  For many machines, that will be more than adequate, but a public-facing machine should probably expect a "real" certificate, which will be Let's Encrypt for many of us, and I'm thinking the setup scripts should accommodate that.

Should the script ask if there's a certificate and then ask for a path, or should it check some well-known locations for evidence of certificates?

I'm not promising a quick turn-around, of course, but sometimes I get stuff done.  Watch for a blue moon.

/dps

[Massimo DiPierro]

This would be great.

--
-- mail from:GoogleGroups "web2py-developers" mailing list
make speech: web2py-d...@googlegroups.com
unsubscribe: web2py-develop...@googlegroups.com
details : http://groups.google.com/group/web2py-developers
the project: http://code.google.com/p/web2py/
official : http://www.web2py.com/
---
You received this message because you are subscribed to the Google Groups "web2py-developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to web2py-develop...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Massimo DiPierro]

on second thought… could this be a python module that returns the certificate?

On Sep 6, 2017, at 7:17 PM, Dave S <snide...@gmail.com> wrote:

[Dave S]

On Wednesday, September 6, 2017 at 5:30:26 PM UTC-7, Massimo Di Pierro wrote:

on second thought… could this be a python module that returns the certificate?

That seems like a thought worth exploring.

/dps
 

[Dave S]

On Wednesday, September 6, 2017 at 5:50:49 PM UTC-7, Dave S wrote:

On Wednesday, September 6, 2017 at 5:30:26 PM UTC-7, Massimo Di Pierro wrote:

on second thought… could this be a python module that returns the certificate?

That seems like a thought worth exploring.

I haven't forgotten this.  Still doing some experiments by hand.

/dps
 

[Dave S]

On Tuesday, September 26, 2017 at 6:33:42 PM UTC-7, Dave S wrote:

On Wednesday, September 6, 2017 at 5:50:49 PM UTC-7, Dave S wrote:

On Wednesday, September 6, 2017 at 5:30:26 PM UTC-7, Massimo Di Pierro wrote:

on second thought… could this be a python module that returns the certificate?

That seems like a thought worth exploring.

I haven't forgotten this.  Still doing some experiments by hand.

I think it's simple enough to look for a Let's Encrypt cert, and to look for a self-signed cert in the place the current install scripts put it, but there doesn't seem to be a convenient way to create a self-signed certificate, since the ssl module expects that to be done with command line tools outside of Python.  I could use popen2, but that seems a little messy.  Maybe I'm unreasonably bothered by the additional prompts; they really just require more writing to the subprocess's stdin, right?