|
Taille: 4066
Commentaire: Mise en place du certificat SHA2
|
Taille: 4068
Commentaire:
|
| Texte supprimé. | Texte ajouté. |
| Ligne 57: | Ligne 57: |
| Ligne 61: | Ligne 62: |
| Ligne 62: | Ligne 64: |
| Ligne 64: | Ligne 65: |
| copy: src={{ ssl_cert_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0644 | copy: src={{ ssl_cert_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0444 |
| Ligne 67: | Ligne 68: |
| copy: src={{ ssl_key_file }}/ dest=/etc/ssl/private owner=root group=root mode=0600 | copy: src={{ ssl_key_file }}/ dest=/etc/ssl/private owner=root group=root mode=0400 |
| Ligne 70: | Ligne 71: |
| copy: src={{ ssl_ca_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0644 | copy: src={{ ssl_ca_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0444 |
Liste Des Sites et Services Utilisant Le Certificat Gandi
Serveur |
VirtualHost Apache |
Observations |
Heartbleed 1 |
listes.auf.org |
/etc/apache2/sites-enabled/mailman |
|
|
new-diogene.auf.org |
/etc/apache2/sites-enabled/000-default |
|
|
/etc/apache2/sites-enabled/10-ressources-humaines.auf.org |
|
|
|
/etc/apache2/sites-enabled/21-informatique.auf.org |
|
|
|
/etc/apache2/sites-enabled/22-ag2013.auf.org |
|
|
|
/etc/apache2/sites-enabled/23-rh-evaluation.auf.org |
|
|
|
/etc/apache2/sites-enabled/25-sigma2.auf.org |
|
|
|
/etc/apache2/sites-enabled/26-cartographie.auf.org |
|
|
|
/etc/apache2/sites-enabled/27-csf-francophonie.auf.org |
|
|
|
www.auf.org |
/etc/apache2/sites-enabled/000-default |
|
|
/etc/apache2/sites-enabled/02-projets-p4.auf.org |
|
|
|
wcs.auf.org |
/etc/apache2/sites-enabled/001-default-ssl |
|
|
/etc/apache2/sites-enabled/01-formulaires.auf.org |
|
|
|
/etc/apache2/sites-enabled/02-test-formulaires.auf.org |
|
|
|
/etc/apache2/sites-enabled/03-anciens-formulaires.auf.org |
|
|
|
/etc/apache2/sites-enabled/04-preprod-formulaires.auf.org |
|
|
|
preprod-web.ca.auf.org |
/etc/apache2/sites-enabled/000-default-ssl |
|
|
/etc/apache2/sites-enabled/17-clavardage.auf.org-ssl |
|
|
|
jutda.auf.org |
/etc/apache2/sites-enabled/00-jutda.auf.org |
|
|
igc.auf.org |
/etc/apache2/sites-enabled/frontal-ejbca |
|
|
wiki.auf.org |
/etc/apache2/sites-enabled/00-wiki |
|
|
redmine.auf.org |
/etc/apache2/sites-enabled/redmine.auf.org |
|
|
redminebeta.auf.org |
/etc/apache2/sites-enabled/redminebeta.auf.org |
|
|
webmail.ca.auf.org |
/etc/apache2/sites-enabled/default-ssl |
|
|
frontal.auf.org |
/etc/apache2/sites-enabled/02-sogo.auf.org-ssl |
|
|
/etc/apache2/sites-enabled/agendas.auf.org-ssl |
|
|
|
/etc/apache2/sites-enabled/default-ssl |
|
|
|
proxy.coda.auf.org |
/etc/apache2/sites-enabled/coda.auf.org-ssl |
|
|
/etc/apache2/sites-enabled/form-coda.auf.org-ssl |
|
|
|
/etc/apache2/sites-enabled/test-coda.auf.org-ssl |
|
|
|
id.auf.org |
/etc/apache2/sites-enabled/authentic2-ssl |
|
|
intranet.auf.org |
/etc/apache2/sites-enabled/intranet.auf.org-ssl |
|
|
/etc/apache2/intranet-proxy/templates/apache-site-ssl |
|
|
|
/etc/apache2/intranet-proxy/apache-site-ssl |
|
|
|
sirh.auf.org |
/etc/apache2/sites-enabled/sirh.auf.org-ssl |
|
|
glpi.auf.org |
/etc/apache2/conf.d/glpi |
|
|
nuage.auf.org |
/etc/apache2/sites-enabled/nuage.auf.org |
|
|
pypi.auf.org |
|||
form-sirh.auf.org |
|||
coda-fw.auf |
|||
coda-www.auf |
|||
test-www.auf.org |
|||
test-nuage.auf.org |
|||
vmphp.auf.org |
Ansible : playbook pour la copie des certificats
mnombre@u-nm:~/mes-outils/ansible$ cat playbook-certs-ssl.yml
---
- name: Déploiement certificat SSL *.auf.org
hosts: certs-gandi-auforg
become: True
vars:
ssl_cert_file: files/_.auf.org-cert.pem
ssl_key_file: files/_.auf.org-key.pem
ssl_ca_file: files/GandiStandardSSLCA.pem
tasks:
- name: Copie du fichier cert
copy: src={{ ssl_cert_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0444
- name: Copie du fichier key
copy: src={{ ssl_key_file }}/ dest=/etc/ssl/private owner=root group=root mode=0400
- name: Copie du fichier CA
copy: src={{ ssl_ca_file }}/ dest=/etc/ssl/certs owner=root group=root mode=0444
- name: redémarrage du service Apache2
service: name=apache2 state=restartedmnombre@u-nm:~/mes-outils/ansible$ ansible-playbook -K playbook-certs-ssl.yml
clée changée avril 2014 ?
voir les annonces: https://www.gandi.net/news/en/2014-04-08/1398-openssl_heartbleed_issue/?lang=fr) -- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 -- http://heartbleed.com/ (1)