Generate Let's Encrypt private key
What does this MR do?
Part of https://gitlab.com/gitlab-org/gitlab-ce/issues/28996
In order to create Let's Encrypt account we need to generate RSA private key.
This MR adds this key to secrets.yml and adds autogeneration of it.
This private key allows to manage all ssl certificates(renew/rewoke) created by Let's Encrypt account.
If secrets.yml will be lost, nothing bad will happen, it can be safely regenerated, and new account will be registered.
This new account can prove ownership of the same domains and obtain new ssl certificate.
That's why I'm not adding anything to https://docs.gitlab.com/ee/raketasks/backup_restore.html#when-the-secrets-file-is-lost
It this key will be stolen, attacker will be able to get new ssl certificates for domains in account and revoke old ones.
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation created/updated or follow-up review issue created -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team