Repository navigation
test(vanity): Let's Encrypt staging HTTP-01 on PR vanity route (test only) - #2929
Draft
DerekRoberts wants to merge 23 commits into
Draft
DerekRoberts wants to merge 23 commits into
DerekRoberts wants to merge 23 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Missing canary secrets can silently fall back to Entrust, allowing deployment of the wrong or mixed certificate set instead of failing validation.
2 open issues
What changed in this PR
Adds an opt-in, non-Entrust TLS canary for the vanity route, supporting issue #2928 while preserving Entrust as the default. Live application and result recording remain manual follow-up steps.
Changes:
- Adds a certificate-set selector to the standalone TLS workflow.
- Adds a script that generates a short-lived personal CA and leaf certificate, then discards the CA key.
- Documents probe results, certificate options, manual execution, rollback, and future renewal considerations.
| File | Description |
|---|---|
scripts/tls-canary-cert.sh |
Generates local canary certificate material without uploading it. |
docs/spike-2928-vanity-tls.md |
Records findings and instructions for the live TLS experiment. |
.github/workflows/route-tls.yml |
Selects Entrust or canary secrets for manual TLS deployment. |
Review effort: Balanced
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
DerekRoberts
marked this pull request as draft
October 31, 2026 06:56
DerekRoberts
changed the title
5 tasks
DerekRoberts
changed the title
…ls canary Revert route-tls.yml and Dockerfile to main. PR deploys mint a throwaway CA and leaf for the vanity host and apply a PR-scoped route via the route-tls action; PR close removes it. Related to #2928.
DerekRoberts
force-pushed
the
feat/vanity-cert-canary
branch
from
November 5, 2026 05:26
6546b65 to
a74ca92
Compare
Replace the throwaway canary script with the action in bcgov/actions-openshift#155, pinned to its branch head, so the live run tests the code being shared instead of a separate copy. Staging only. Refs #2928
Staging passed on the live host with this action, so issue one browser-trusted certificate for quickstart.nrs.gov.bc.ca. Refs #2928
The one approved production run is done, so later pushes must not issue another production certificate. Refs #2928
Replaces the acme-http01 and route-tls steps with the single cert-keeper action from bcgov/actions-openshift#155, first with force off to prove it leaves a healthy certificate alone. Refs #2928
The forced run lost its certificate to a Pod lifetime bug in cert-keeper. Refs #2928
cert-keeper issued and installed a certificate on the live host. Refs #2928
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We needed to prove bcgov/actions-openshift#155 can issue a browser-trusted certificate for
quickstart.nrs.gov.bc.cafrom Actions, with no Service Desk ticket. Not for merge: this PR only exercises that action on a PR deploy.vanityjob calledbcgov/actions-openshift/acme-http01(Create code-gov-data JS in pipeline #155) androute-tls(Junk commit #156), pinned to their branch heads. The job is now off (if: false), because a production certificate is live and each run would replace it. Notes are indocs/spike-2928-vanity-tls.md.quickstart-openshift-2929-vanity, which takes the certificate with it. Re-enabling the job issues another production certificate, limited to 5 per host per 7 days. The certificate expires 2027-02-05 and nothing renews it yet.curl https://quickstart.nrs.gov.bc.caverified without-k, andopenssl s_clientshowed issuerYR1,ISRG Root X1in the chain andVerify return code: 0.Related to #2928, bcgov/actions-openshift#153