Switch to LE certs for sip / repro

diff --git a/modules/roles/manifests/rtc.pp b/modules/roles/manifests/rtc.pp
index 888b113..7382d18 100644 (file)
--- a/modules/roles/manifests/rtc.pp
+++ b/modules/roles/manifests/rtc.pp
@@ -1,12 +1,13 @@
 class roles::rtc {
 
-       ssl::service { 'www.debian.org':
+       ssl::service { 'debian.org':
                tlsaport => [],
                notify  => Service['repro'],
+               key => true,
        }
 
        ssl::service { 'sip-ws.debian.org':
-               tlsaport => [],
+               key => true,
        }
 
        dnsextras::tlsa_record{ 'tlsa-xmpp':

diff --git a/modules/ssl/files/chains/sip-ws.debian.org.crt b/modules/ssl/files/chains/sip-ws.debian.org.crt
deleted file mode 120000 (symlink)
index 50d224a..0000000
--- a/modules/ssl/files/chains/sip-ws.debian.org.crt
+++ /dev/null
@@ -1 +0,0 @@
-GANDI-2-CA
\ No newline at end of file

diff --git a/modules/ssl/files/servicecerts/sip-ws.debian.org.crt b/modules/ssl/files/servicecerts/sip-ws.debian.org.crt
deleted file mode 100644 (file)
index c49e73d..0000000
--- a/modules/ssl/files/servicecerts/sip-ws.debian.org.crt
+++ /dev/null
@@ -1,118 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            27:fd:61:53:34:d0:3e:c7:d0:99:c2:42:d7:b9:f9:db
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=FR, ST=Paris, L=Paris, O=Gandi, CN=Gandi Standard SSL CA 2
-        Validity
-            Not Before: Dec 11 00:00:00 2015 GMT
-            Not After : Feb 15 23:59:59 2017 GMT
-        Subject: OU=Domain Control Validated, OU=Gandi Standard SSL, CN=sip-ws.debian.org
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (3072 bit)
-                Modulus:
-                    00:ba:a6:d2:26:06:bc:41:7e:32:0d:ba:e4:0a:66:
-                    6e:3a:60:9f:d5:f8:53:3b:fe:44:9e:14:32:4b:b9:
-                    5b:a9:6c:68:c3:a8:ff:10:a8:39:be:a0:74:dd:45:
-                    18:d2:e6:26:04:52:c3:bc:47:d4:7e:85:ea:64:e6:
-                    dd:aa:eb:ef:8c:fa:02:6a:86:6f:2b:c3:67:98:a9:
-                    01:16:2d:f1:9a:b7:99:32:08:a5:2c:c0:4a:71:9b:
-                    7d:8a:3f:b0:52:62:32:8f:5f:51:fb:2d:3d:9a:b3:
-                    43:b5:ed:ee:13:ab:5a:7b:b1:aa:d9:63:ca:a7:25:
-                    79:b8:d1:1b:e6:9f:7f:9d:ac:27:2b:d4:f2:b9:7e:
-                    56:ac:c0:e0:dd:a0:2f:a6:06:67:51:d6:b7:65:11:
-                    7c:0f:09:c2:16:cb:7f:78:c2:f4:7d:d8:8f:c0:c5:
-                    98:74:7b:d8:af:f6:b7:19:ec:19:fb:47:5a:d3:86:
-                    5b:20:4d:e2:da:1c:77:6d:61:2d:65:8e:64:ae:0d:
-                    00:ba:8c:c3:49:57:5f:95:6f:5c:21:c6:ed:67:40:
-                    67:39:c8:43:0c:bc:61:f6:c1:f9:27:bf:5d:d9:47:
-                    9a:05:a0:ff:ad:d3:e5:0a:48:09:68:d5:d1:92:b9:
-                    26:50:b8:1b:a4:7b:a9:3b:f0:0f:b3:ff:f8:02:74:
-                    47:f0:3b:6f:80:d4:57:e4:93:7e:81:04:14:29:1e:
-                    84:63:d8:70:0d:3f:5c:53:d3:e7:b0:36:b2:21:2a:
-                    2a:2f:bc:ad:a1:c9:71:b6:c2:43:d3:dd:23:70:65:
-                    ce:c9:a4:55:58:95:f0:66:81:3d:5f:65:b3:35:67:
-                    b1:0c:82:86:84:4b:f9:0a:fa:75:7f:99:8b:8c:da:
-                    91:7a:db:85:53:1d:e4:12:81:74:be:6b:c0:d0:3c:
-                    fa:88:35:74:55:6a:d7:85:26:fa:6a:d8:c2:a6:ce:
-                    75:17:a2:0c:23:b8:a0:a1:c3:9d:ab:8b:51:67:4a:
-                    1e:a3:21:58:06:1f:de:37:bd:4f
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Authority Key Identifier: 
-                keyid:B3:90:A7:D8:C9:AF:4E:CD:61:3C:9F:7C:AD:5D:7F:41:FD:69:30:EA
-
-            X509v3 Subject Key Identifier: 
-                E9:DC:7B:40:D6:C8:59:1D:4D:65:BE:00:B4:96:8F:DF:6B:F9:F4:FE
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Certificate Policies: 
-                Policy: 1.3.6.1.4.1.6449.1.2.2.26
-                  CPS: https://cps.usertrust.com
-                Policy: 2.23.140.1.2.1
-
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://crl.usertrust.com/GandiStandardSSLCA2.crl
-
-            Authority Information Access: 
-                CA Issuers - URI:http://crt.usertrust.com/GandiStandardSSLCA2.crt
-                OCSP - URI:http://ocsp.usertrust.com
-
-            X509v3 Subject Alternative Name: 
-                DNS:sip-ws.debian.org, DNS:www.sip-ws.debian.org
-    Signature Algorithm: sha256WithRSAEncryption
-         5c:af:8c:b9:f5:dd:e2:d5:2b:a6:ed:31:e3:c1:7f:9d:b4:ca:
-         98:08:1d:bf:58:f6:8a:bb:5a:39:e1:31:2b:be:5b:66:a3:c5:
-         e5:33:17:1d:9e:d6:ac:e0:5b:65:da:8d:26:4b:cc:1f:51:f2:
-         4a:3c:ea:47:e1:f5:f1:63:9f:90:99:f9:21:59:a7:42:cd:90:
-         2b:36:4c:82:b7:cf:40:02:72:a8:41:cb:c7:d9:07:8f:66:9b:
-         9a:37:23:79:ea:57:6c:d0:17:3e:79:3e:16:8b:d5:6f:c7:ee:
-         c6:45:12:f8:25:50:db:a2:10:75:8a:2f:61:a1:2e:7f:33:84:
-         98:f7:83:b7:9d:f7:d9:86:12:c7:ce:30:08:74:9b:b9:69:1b:
-         46:3d:b9:81:6d:bc:9c:27:90:48:72:f7:29:f0:c2:d8:cf:0b:
-         62:95:dc:19:f7:0d:ac:8b:40:4b:76:07:66:a4:4b:74:da:d1:
-         db:62:65:33:02:16:17:4b:53:21:53:bb:4d:6c:6f:c1:c6:ad:
-         2a:da:4e:ee:bf:ad:33:36:e7:4e:b7:cf:aa:3d:1f:42:69:6c:
-         58:1e:36:eb:4c:7b:bd:6e:ef:23:9e:c2:7a:08:33:d4:3b:92:
-         4b:b5:a2:2a:09:87:b9:0e:46:5e:7c:44:8f:2e:a1:7e:ca:fa:
-         07:38:3c:3c
------BEGIN CERTIFICATE-----
-MIIFgjCCBGqgAwIBAgIQJ/1hUzTQPsfQmcJC17n52zANBgkqhkiG9w0BAQsFADBf
-MQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4w
-DAYDVQQKEwVHYW5kaTEgMB4GA1UEAxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIw
-HhcNMTUxMjExMDAwMDAwWhcNMTcwMjE1MjM1OTU5WjBcMSEwHwYDVQQLExhEb21h
-aW4gQ29udHJvbCBWYWxpZGF0ZWQxGzAZBgNVBAsTEkdhbmRpIFN0YW5kYXJkIFNT
-TDEaMBgGA1UEAxMRc2lwLXdzLmRlYmlhbi5vcmcwggGiMA0GCSqGSIb3DQEBAQUA
-A4IBjwAwggGKAoIBgQC6ptImBrxBfjINuuQKZm46YJ/V+FM7/kSeFDJLuVupbGjD
-qP8QqDm+oHTdRRjS5iYEUsO8R9R+hepk5t2q6++M+gJqhm8rw2eYqQEWLfGat5ky
-CKUswEpxm32KP7BSYjKPX1H7LT2as0O17e4Tq1p7sarZY8qnJXm40Rvmn3+drCcr
-1PK5flaswODdoC+mBmdR1rdlEXwPCcIWy394wvR92I/AxZh0e9iv9rcZ7Bn7R1rT
-hlsgTeLaHHdtYS1ljmSuDQC6jMNJV1+Vb1whxu1nQGc5yEMMvGH2wfknv13ZR5oF
-oP+t0+UKSAlo1dGSuSZQuBuke6k78A+z//gCdEfwO2+A1Ffkk36BBBQpHoRj2HAN
-P1xT0+ewNrIhKiovvK2hyXG2wkPT3SNwZc7JpFVYlfBmgT1fZbM1Z7EMgoaES/kK
-+nV/mYuM2pF624VTHeQSgXS+a8DQPPqINXRVateFJvpq2MKmznUXogwjuKChw52r
-i1FnSh6jIVgGH943vU8CAwEAAaOCAbswggG3MB8GA1UdIwQYMBaAFLOQp9jJr07N
-YTyffK1df0H9aTDqMB0GA1UdDgQWBBTp3HtA1shZHU1lvgC0lo/fa/n0/jAOBgNV
-HQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
-KwYBBQUHAwIwSwYDVR0gBEQwQjA2BgsrBgEEAbIxAQICGjAnMCUGCCsGAQUFBwIB
-FhlodHRwczovL2Nwcy51c2VydHJ1c3QuY29tMAgGBmeBDAECATBBBgNVHR8EOjA4
-MDagNKAyhjBodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vR2FuZGlTdGFuZGFyZFNT
-TENBMi5jcmwwcwYIKwYBBQUHAQEEZzBlMDwGCCsGAQUFBzAChjBodHRwOi8vY3J0
-LnVzZXJ0cnVzdC5jb20vR2FuZGlTdGFuZGFyZFNTTENBMi5jcnQwJQYIKwYBBQUH
-MAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wMwYDVR0RBCwwKoIRc2lwLXdz
-LmRlYmlhbi5vcmeCFXd3dy5zaXAtd3MuZGViaWFuLm9yZzANBgkqhkiG9w0BAQsF
-AAOCAQEAXK+MufXd4tUrpu0x48F/nbTKmAgdv1j2irtaOeExK75bZqPF5TMXHZ7W
-rOBbZdqNJkvMH1HySjzqR+H18WOfkJn5IVmnQs2QKzZMgrfPQAJyqEHLx9kHj2ab
-mjcjeepXbNAXPnk+FovVb8fuxkUS+CVQ26IQdYovYaEufzOEmPeDt5332YYSx84w
-CHSbuWkbRj25gW28nCeQSHL3KfDC2M8LYpXcGfcNrItAS3YHZqRLdNrR22JlMwIW
-F0tTIVO7TWxvwcatKtpO7r+tMzbnTrfPqj0fQmlsWB4260x7vW7vI57Ceggz1DuS
-S7WiKgmHuQ5GXnxEjy6hfsr6Bzg8PA==
------END CERTIFICATE-----