spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

DEPLOY: the internal CA and the DC and relay certificates are SHA-1; test stack layout under the home folder
ci / frontend (push) Successful in 35s
Details
ci / server (push) Successful in 16m49s
Details
ci / image (push) Successful in 16s
Details
ci / e2e (push) Successful in 1m50s
Details

Browse Source 
Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
spencerm
2026-10-17 12:00:17 -06:00
co-authored by Claude Fable 5.1
parent 5a4174e0c2
commit c244a684b2
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DEPLOY.md
+10
View File
@@ -162,6 +162,16 @@ Open check (plan question 16): confirm "Block common exploits" does not interfer
The app trusts `X-Forwarded-*` only from `npm_app_1`'s own address, re-resolved every 60 seconds. Other stacks share `npm_default`, and the per-address rate limit depends on the real client address.
## Known issue: the internal CA signs with SHA-1 (found 2026-10-17)
PESCO-PSYLOCKE-CA (valid to 2027-09-27) signs with sha1WithRSAEncryption, and so do the certificates it issued to DC-02.PESCO.COM and PDC-1.PESCO.COM on 636 and to APP-03.PESCO.COM on 25 (all valid to April 2027). OpenSSL 3 on Debian 12 refuses SHA-1 signatures at its default security level 2, so LDAPS and SMTP STARTTLS fail from inside the image with "CA signature digest algorithm too weak", while Windows and browsers still accept them. Verification passes at security level 0.
mfiles.pescoinc.biz uses a public Let's Encrypt certificate, so MFILES_CA_BUNDLE must stay unset; only LDAP_CA_BUNDLE and SMTP_CA_BUNDLE point at the PESCO chain.
The fix is IT's: set the CA to issue with SHA-256 and reissue the domain controller and relay certificates. The CA certificate itself may stay SHA-1, since OpenSSL does not check the trust anchor's own signature. Until then the test stack cannot sign in or verify the relay without a test-only OpenSSL security-level override, which is Spencer's decision to apply, never the production stack's. The doctor should report a SHA-1 chain with this hint (follow-up).
The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack.env, secrets/, ca/pesco-ca.pem, backups/) because the session that set it up had no sudo; move it to /etc/packetstation/test when convenient.
## Doctor
`packetstation doctor` proves a host and a stack are ready. Run it inside the image: