Skip to content
Snippets Groups Projects
Closed Ensure Cert Manager works with Auto DevOps URLs
  • View options
  • Ensure Cert Manager works with Auto DevOps URLs

  • View options
  • Ensure Cert Manager works with Auto DevOps URLs

    Closed Issue created by Jesse L.

    Auto DevOps failures in Let's Encrypt with long domain names

    With a long domain name the autogenerated URL for an auto-devops app can break the cert management:

    I1015 18:24:42.009889       1 sync.go:288] Error issuing certificate for **redacted**: error getting certificate from acme server: acme: urn:ietf:params:acme:error:malformed: Error finalizing order :: CN was longer than 64 bytes

    It seems that the name generation needs to notice if the auto-generated name is too long for Let's Encrypt to handle.

    Proposal

    It seems that Let's Encrypt can happily handle these long URLs when they are used in as the Subject Alternative Name and it only has a problem when used as Common Name (see https://community.letsencrypt.org/t/ssl-for-a-63-character-max-number-of-characters-domain-name-s/36387/14). So we can just hardcode a short SSL common name le.$AUTO_DEVOPS_BASE_DOMAIN and then add all the hosts as Subject Alternative Names. This way we don't need to change our strategy for generating domain names just yet.

    Note this will only solve this issue and will not solve https://gitlab.com/gitlab-org/gitlab-ce/issues/52990 so we will need to do this separately.

    Edited by Dylan Griffith

    Linked items ... 0

  • Activity

    • All activity
    • Comments only
    • History only
    • Newest first
    • Oldest first
    Loading Loading Loading Loading Loading Loading Loading Loading Loading Loading