Skip to content

Ensure Cert Manager works with Auto DevOps URLs

Auto DevOps failures in Let's Encrypt with long domain names

With a long domain name the autogenerated URL for an auto-devops app can break the cert management:

I1015 18:24:42.009889       1 sync.go:288] Error issuing certificate for **redacted**: error getting certificate from acme server: acme: urn:ietf:params:acme:error:malformed: Error finalizing order :: CN was longer than 64 bytes

It seems that the name generation needs to notice if the auto-generated name is too long for Let's Encrypt to handle.

Proposal

It seems that Let's Encrypt can happily handle these long URLs when they are used in as the Subject Alternative Name and it only has a problem when used as Common Name (see https://community.letsencrypt.org/t/ssl-for-a-63-character-max-number-of-characters-domain-name-s/36387/14). So we can just hardcode a short SSL common name le.$AUTO_DEVOPS_BASE_DOMAIN and then add all the hosts as Subject Alternative Names. This way we don't need to change our strategy for generating domain names just yet.

Note this will only solve this issue and will not solve https://gitlab.com/gitlab-org/gitlab-ce/issues/52990 so we will need to do this separately.

Edited by Dylan Griffith