From 6451ff60ba0b9591f559426e48eff2cd673b36ad Mon Sep 17 00:00:00 2001 From: Julien Bisconti Date: Thu, 22 Aug 2019 13:58:37 +0200 Subject: [PATCH] Add troubleshooting section for https (#754) * Add troubleshooting section for https Co-Authored-By: Luke Kysow <1034429+lkysow@users.noreply.github.com> --- runatlantis.io/.vuepress/config.js | 7 +++++ runatlantis.io/docs/troubleshooting-https.md | 27 ++++++++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 runatlantis.io/docs/troubleshooting-https.md diff --git a/runatlantis.io/.vuepress/config.js b/runatlantis.io/.vuepress/config.js index 73a15c1c1..9b9b8d851 100644 --- a/runatlantis.io/.vuepress/config.js +++ b/runatlantis.io/.vuepress/config.js @@ -86,6 +86,13 @@ module.exports = { 'automerging', 'security' ] + }, + { + title: 'Troubleshooting', + collapsable: true, + children: [ + 'troubleshooting-https', + ] } ] }, diff --git a/runatlantis.io/docs/troubleshooting-https.md b/runatlantis.io/docs/troubleshooting-https.md new file mode 100644 index 000000000..9d46e6813 --- /dev/null +++ b/runatlantis.io/docs/troubleshooting-https.md @@ -0,0 +1,27 @@ +# HTTPS, SSL, TLS + +When using a self-signed certificate for Atlantis (with flags `--ssl-cert-file` and `--ssl-key-file`), +there are a few considerations. + +Atlantis uses the web server from the standard Go library, +the method name is [ListenAndServeTLS](https://golang.org/pkg/net/http/#ListenAndServeTLS). + +`ListenAndServeTLS` acts identically to [ListenAndServe](https://golang.org/pkg/net/http/#ListenAndServe), +except that it expects HTTPS connections. +Additionally, files containing a certificate and matching private key for the server must be provided. +If the certificate is signed by a certificate authority, +the file passed to `--ssl-cert-file` should be the concatenation of the server's certificate, any intermediates, and the CA's certificate. + +If you have this error when specifying a TLS cert with a key: +``` +[EROR] server.go:413 server: Tls: private key does not match public key +``` + +Check that the locally signed certificate authority is prepended to the self signed certificate. +A good example is shown at [Seth Vargo terraform implementation of atlantis-on-gke](https://github.com/sethvargo/atlantis-on-gke/blob/master/terraform/tls.tf#L64) + +For Go specific TLS resources have a look at the repository by [denji called golang-tls](https://github.com/denji/golang-tls). + +For a complete explanation on PKI, read this [article](https://smallstep.com/blog/everything-pki.html). + +