diff options
author | Vincent Bernat <vincent@bernat.ch> | 2021-05-30 13:12:32 +0200 |
---|---|---|
committer | Martin Weinelt <hexa@darmstadt.ccc.de> | 2021-06-01 00:43:45 +0200 |
commit | 632c8e1d54e299f656aa677f25552e1127f12849 (patch) | |
tree | 01c62b715b94760ea2ef9b8f3199bfcaa32237b2 | |
parent | 774fe1878b045411e6bdd0dd90d8581e82b10993 (diff) | |
download | nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar.gz nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar.bz2 nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar.lz nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar.xz nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.tar.zst nixpkgs-632c8e1d54e299f656aa677f25552e1127f12849.zip |
nixos/acme: don't use --reuse-key
Reusing the same private/public key on renewal has two issues: - some providers don't accept to sign the same public key again (Buypass Go SSL) - keeping the same private key forever partly defeats the purpose of renewing the certificate often Therefore, let's remove this option. People wanting to keep the same key can set extraLegoRenewFlags to `[ --reuse-key ]` to keep the previous behavior. Alternatively, we could put this as an option whose default value is true.
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2105.xml | 10 | ||||
-rw-r--r-- | nixos/modules/security/acme.nix | 2 |
2 files changed, 11 insertions, 1 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml index 12a9ae2f44e..489d74e1aef 100644 --- a/nixos/doc/manual/release-notes/rl-2105.xml +++ b/nixos/doc/manual/release-notes/rl-2105.xml @@ -804,6 +804,16 @@ environment.systemPackages = [ the deprecated <option>services.radicale.config</option> is used. </para> </listitem> + <listitem> + <para> + In the <option>security.acme</option> module, use of <literal>--reuse-key</literal> + parameter for Lego has been removed. It was introduced for HKPK, but this security + feature is now deprecated. It is a better security practice to rotate key pairs + instead of always keeping the same. If you need to keep this parameter, you can add + it back using <literal>extraLegoRenewFlags</literal> as an option for the + appropriate certificate. + </para> + </listitem> </itemizedlist> </section> diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index eb3599b924d..c0250171109 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -152,7 +152,7 @@ let ); renewOpts = escapeShellArgs ( commonOpts - ++ [ "renew" "--reuse-key" ] + ++ [ "renew" ] ++ optionals data.ocspMustStaple [ "--must-staple" ] ++ data.extraLegoRenewFlags ); |