From 2b6faa362f3ee2a63e3597f8734867d8e9d4df7d Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Thu, 20 Feb 2020 18:26:08 +1100 Subject: [PATCH] acme: ipa-pki-proxy: proxy /acme to Dogtag Update ipa-pki-proxy.conf to proxy requests to the /acme resource namespace to Dogtag. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden --- install/share/ipa-pki-proxy.conf.template | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/install/share/ipa-pki-proxy.conf.template b/install/share/ipa-pki-proxy.conf.template index 60088e226..96708482c 100644 --- a/install/share/ipa-pki-proxy.conf.template +++ b/install/share/ipa-pki-proxy.conf.template @@ -1,4 +1,4 @@ -# VERSION 15 - DO NOT REMOVE THIS LINE +# VERSION 16 - DO NOT REMOVE THIS LINE ProxyRequests Off @@ -34,5 +34,15 @@ ProxyRequests Off ProxyPassReverse ajp://localhost:$DOGTAG_PORT +# Matches for ACME service + + SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate + # RFC 8555 says HTTPS is REQUIRED + SSLRequireSSL + SSLVerifyClient none + ProxyPassMatch ajp://localhost:$DOGTAG_PORT + ProxyPassReverse ajp://localhost:$DOGTAG_PORT + + # Only enable this on servers that are not generating a CRL ${CLONE}RewriteRule ^/ipa/crl/MasterCRL.bin http://$FQDN/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]