sandstorm icon indicating copy to clipboard operation
sandstorm copied to clipboard

Add `sandstorm tls-keys` command for uploading key/cert

Open kentonv opened this issue 4 years ago • 3 comments

We should add a new sandstorm command:

sandstorm tls-keys <key-file> <cert-chain-file>

This would simply read the two files and inject them into the database as the new TLS keys.

This would be useful for a couple situations:

  • When the current cert is invalid, it can be very hard to convince the browser to accept it. I find that even clicking through the certificate warning isn't enough because the WebSocket / XHR requests remain blocked, meaning none of the UI works (including the TLS certificate upload UI).
  • This command could be used in external scripts that update TLS certs. For example, this could allow someone to use certbot to renew certificates in the case that their DNS provider is supported by certbot but not yet by ACME.js.

The command could be implemented by reading the two files and then passing a query to mongo like:

db.settings.update({_id: 'tlsKeys'}, {$set: {value: {key: '<key-file-content>', certChain: '<cert-chain-file-content>'}}})

One catch: The mongo client program barfs when given single lines longer than 4096 characters. So, it's necessary to break up the strings across multiple lines. The query language is literally JavaScript so this could either be accomplished by defining a bunch of variables containing chunks of the text and then concatenating them, or maybe just by splitting the string literals across multiple lines with + to concatenate.

kentonv avatar May 02 '20 21:05 kentonv