From f47699d7b0749a680b18d57a79f429f56bb903f3 Mon Sep 17 00:00:00 2001 From: satoshi Date: Fri, 24 Apr 2026 00:45:29 +0300 Subject: [PATCH] Harden TLS cert generation with a version marker and openssl config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix relied on inspecting the existing cert for a subjectAltName extension to decide whether to regenerate. That works but is brittle — it depends on openssl text output format and on the assumption that SAN is the only thing that could go wrong. If a future client rejects us for some *other* missing extension, we'd be stuck on a bad cert again. Switch to an explicit cert version marker (TLS_CERT_VERSION). Any time we change the cert shape, we bump the version; the startup check regenerates whenever the marker file is absent or out of date. Upgrades self-heal on next boot with no introspection. Write the full extension set via an openssl config file instead of -addext flags. -addext is subtly different across openssl versions (in some builds the extension lands in the CSR rather than the cert). The config-file path is the documented, portable way to pin basicConstraints, keyUsage, extendedKeyUsage, subjectKeyIdentifier, and subjectAltName together. Also log the resulting extensions at startup so operators can verify cert sanity from the service logs without exec'ing into the container, and pin a modern TLS floor in stunnel.conf (no SSL3, no TLSv1, no TLSv1.1). --- docker_entrypoint.sh | 82 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 65 insertions(+), 17 deletions(-) diff --git a/docker_entrypoint.sh b/docker_entrypoint.sh index 5555bc6..d02681b 100755 --- a/docker_entrypoint.sh +++ b/docker_entrypoint.sh @@ -142,36 +142,77 @@ if [[ "${TLS_ENABLED}" == "enabled" ]]; then CRT="${TLS_DIR}/stratum.crt" KEY="${TLS_DIR}/stratum.key" CERT="${TLS_DIR}/stratum.pem" + MARKER="${TLS_DIR}/cert_version" mkdir -p "${TLS_DIR}" - # Regenerate when the cert is missing, OR when an older cert lacks - # a subjectAltName extension. Strict TLS clients (Go, Rust, - # mbedtls, most modern miner firmwares) reject CN-only certs with - # a "bad certificate" alert, which is what we saw in the logs on - # older Kamado installs. + # Bump TLS_CERT_VERSION any time the cert format/extensions change. + # The startup check regenerates whenever the marker file is missing + # or doesn't match this version. This is more reliable than poking + # at the existing cert's extensions — we know *exactly* when a new + # shape is required and the upgrade self-heals on next boot. + TLS_CERT_VERSION=3 + NEEDS_REGEN=false if [[ ! -f "${CERT}" || ! -f "${CRT}" || ! -f "${KEY}" ]]; then NEEDS_REGEN=true - elif ! openssl x509 -in "${CRT}" -noout -ext subjectAltName 2>/dev/null \ - | grep -qE "DNS:|IP:"; then - echo "kamado-entrypoint: existing TLS cert lacks subjectAltName; regenerating" + elif [[ ! -f "${MARKER}" ]] \ + || [[ "$(cat "${MARKER}" 2>/dev/null)" != "${TLS_CERT_VERSION}" ]]; then + echo "kamado-entrypoint: TLS cert is older format (want v${TLS_CERT_VERSION}); regenerating" NEEDS_REGEN=true fi if [[ "${NEEDS_REGEN}" == "true" ]]; then - echo "kamado-entrypoint: generating self-signed stratum TLS cert" - openssl req -x509 -newkey rsa:2048 -sha256 -nodes \ + echo "kamado-entrypoint: generating self-signed stratum TLS cert v${TLS_CERT_VERSION}" + # Write the extensions to a config file rather than rely on + # `-addext`: some openssl builds emit them into unpredictable + # locations (e.g. CSR instead of the cert), and this is the + # documented, cross-version way to pin the full extension set. + CONF=$(mktemp) + cat > "${CONF}" <<'OPENSSL_CONF' +[ req ] +default_bits = 2048 +default_md = sha256 +prompt = no +distinguished_name = req_dn +x509_extensions = v3_cert + +[ req_dn ] +CN = kamado-pool + +[ v3_cert ] +basicConstraints = critical, CA:FALSE +keyUsage = critical, digitalSignature, keyEncipherment +extendedKeyUsage = serverAuth +subjectKeyIdentifier = hash +subjectAltName = @alt_names + +[ alt_names ] +DNS.1 = kamado-pool.embassy +DNS.2 = kamado-pool +DNS.3 = localhost +IP.1 = 127.0.0.1 +OPENSSL_CONF + + openssl req -x509 -newkey rsa:2048 -nodes \ -keyout "${KEY}" \ -out "${CRT}" \ -days 3650 \ - -subj "/CN=kamado-pool-stratum" \ - -addext "subjectAltName = DNS:kamado-pool.embassy, DNS:localhost, IP:127.0.0.1" \ - -addext "extendedKeyUsage = serverAuth" \ + -config "${CONF}" \ >/dev/null 2>&1 - # stunnel happily reads cert+key in either order, but cert-first - # is the convention openssl and most tooling expect. + rm -f "${CONF}" + + # stunnel reads cert+key in either order, but cert-first is the + # convention openssl and most tooling expect. cat "${CRT}" "${KEY}" > "${CERT}" chmod 600 "${KEY}" "${CERT}" + printf '%s\n' "${TLS_CERT_VERSION}" > "${MARKER}" + + # Log the extensions so operators can verify the cert is sane + # from the service logs without needing to exec into the + # container. + echo "kamado-entrypoint: cert extensions:" + openssl x509 -in "${CRT}" -noout -ext subjectAltName,extendedKeyUsage,keyUsage 2>&1 \ + | sed 's/^/ /' fi FINGERPRINT=$(openssl x509 -in "${CRT}" -noout -fingerprint -sha256 | cut -d= -f2) @@ -185,13 +226,20 @@ foreground = yes pid = output = /dev/stdout debug = 4 +# Pin a modern TLS floor. Any miner firmware younger than ~2018 +# speaks TLS 1.2, and TLS 1.0/1.1 are deprecated anyway. +sslVersion = all +options = NO_SSLv2 +options = NO_SSLv3 +options = NO_TLSv1 +options = NO_TLSv1_1 [stratum] accept = 0.0.0.0:${TLS_PORT} connect = 127.0.0.1:${STRATUM_PORT} cert = ${CERT} -# No client-cert auth — stratum over TLS is opportunistic encryption, -# the stratum layer handles miner auth via username. +# No client-cert auth — stratum over TLS is opportunistic encryption; +# the stratum protocol layer handles miner auth via username. verify = 0 EOF