From 47afcbf35a8b0b9952daeaff50a295782dfa6749 Mon Sep 17 00:00:00 2001 From: montag Date: Mon, 1 May 2017 10:40:54 -0700 Subject: [PATCH] Tls cert bugfix (#262) * Bugfix for systems that cannot generate openssl certs. Includes self-signed certs that expire in 10 years. Removed automatic cert generation from install-deps.sh. Updated create-cert.sh to manually generate 10year certs (or any custom duration). * Docker config changes to support web demo TLS --- Dockerfile | 5 ++++- demos/web/create-cert.sh | 3 ++- demos/web/install-deps.sh | 5 ++--- demos/web/requirements.txt | 4 ++++ demos/web/tls/server.crt | 13 +++++++++++++ demos/web/tls/server.key | 15 +++++++++++++++ demos/web/tls/server.pem | 28 ++++++++++++++++++++++++++++ 7 files changed, 68 insertions(+), 5 deletions(-) create mode 100644 demos/web/tls/server.crt create mode 100644 demos/web/tls/server.key create mode 100644 demos/web/tls/server.pem diff --git a/Dockerfile b/Dockerfile index 9bdd46e..5edadf0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,13 +8,16 @@ RUN apt-get update && apt-get install -y \ curl \ git \ graphicsmagick \ + libssl-dev \ + libffi-dev \ python-dev \ python-pip \ python-numpy \ python-nose \ python-scipy \ python-pandas \ - python-protobuf\ + python-protobuf \ + python-openssl \ wget \ zip \ && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* diff --git a/demos/web/create-cert.sh b/demos/web/create-cert.sh index 50c9e00..8fec75d 100644 --- a/demos/web/create-cert.sh +++ b/demos/web/create-cert.sh @@ -1,10 +1,11 @@ # generate self-signed certs with no password for the web and socket servers +# this script requires that openssl is installed: e.g. sudo apt-get install openssl mkdir tls openssl genrsa -des3 -out tls/server.key 1024 openssl req -new -key tls/server.key -out tls/server.csr cp tls/server.key tls/server.key.org openssl rsa -in tls/server.key.org -out tls/server.key -openssl x509 -req -days 365 -in tls/server.csr -signkey tls/server.key -out tls/server.crt +openssl x509 -req -days 3650 -in tls/server.csr -signkey tls/server.key -out tls/server.crt echo 'converting to pem' cat tls/server.crt tls/server.key > tls/server.pem echo 'cert complete' diff --git a/demos/web/install-deps.sh b/demos/web/install-deps.sh index 90238e1..98b8f55 100755 --- a/demos/web/install-deps.sh +++ b/demos/web/install-deps.sh @@ -7,11 +7,10 @@ sudo apt-get install -y libprotobuf-dev libleveldb-dev libsnappy-dev \ libopencv-dev libhdf5-serial-dev libboost-all-dev libgflags-dev \ libgoogle-glog-dev liblmdb-dev protobuf-compiler libboost-all-dev \ libatlas-dev libatlas-base-dev liblapack-dev libblas-dev \ - python-pip python-numpy python-imaging python-opencv \ + libssl-dev libffi-dev python-pip python-numpy python-imaging \ + python-openssl python-opencv \ git wget cmake gfortran -source ~/openface/demos/web/create-cert.sh - mkdir -p ~/src cd ~/src git clone https://github.com/bvlc/caffe.git diff --git a/demos/web/requirements.txt b/demos/web/requirements.txt index 3f3ba31..455fa98 100644 --- a/demos/web/requirements.txt +++ b/demos/web/requirements.txt @@ -4,3 +4,7 @@ twisted == 15.2.1 scipy >= 0.13, < 0.17 scikit-learn >= 0.17, < 0.18 protobuf >= 2.5, < 2.7 +appdirs >= 1.4.3 +pyOpenSSL >= 17.0.0 +cryptography >= 1.8.1 +service-identity >= 16.0.0 diff --git a/demos/web/tls/server.crt b/demos/web/tls/server.crt new file mode 100644 index 0000000..13d9e6d --- /dev/null +++ b/demos/web/tls/server.crt @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIICATCCAWoCCQC0Yl1TUb3gjzANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJB +VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0 +cyBQdHkgTHRkMB4XDTE3MDQzMDE2MDIxNFoXDTI3MDQyODE2MDIxNFowRTELMAkG +A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0 +IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApnSL +fpgnKHKCNypUxedbBMik02B40zlK5jQUqAt8ityNYM4DxZV2pOwS4RLfgDrWfLKV +kOiBL+2iJmNWtc8fcU/4MnhAUCgYXvl+o3yFu8EVOLU+FXhlqJRAJOpqESMVa+II +haXDSuLLnSA0e/UrxhDmWEiTGAkteWPLyEP7G6kCAwEAATANBgkqhkiG9w0BAQsF +AAOBgQAwYgs2CrrCoknDs2p2bS/sEBc/cAWxlB3VA0yQXTAxh+6rLOYLwoF+z92w +IbUhUkZss1r0k7zZDBZ32ZEB6Hc0+q4r599UVV3gF/2Ongc6rvtzJtRAv5EZza0d +l3aaZ0aPu09XuDqv9cb/g+i/L7RgQgoEiEpK60WoTm9FeJ4Fpw== +-----END CERTIFICATE----- diff --git a/demos/web/tls/server.key b/demos/web/tls/server.key new file mode 100644 index 0000000..9f1ac75 --- /dev/null +++ b/demos/web/tls/server.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICWwIBAAKBgQCmdIt+mCcocoI3KlTF51sEyKTTYHjTOUrmNBSoC3yK3I1gzgPF +lXak7BLhEt+AOtZ8spWQ6IEv7aImY1a1zx9xT/gyeEBQKBhe+X6jfIW7wRU4tT4V +eGWolEAk6moRIxVr4giFpcNK4sudIDR79SvGEOZYSJMYCS15Y8vIQ/sbqQIDAQAB +AoGAAM7D9oNKfVnA4/+ilas/t9A5bIUlUPEQOfm6t+4GVq4nSXb2cbj98GLs3Ia4 +6uheLhC3xRI7vj3K8aC9xPgSUPpvdqEfef+SlfC7/lcHdtIfz1Fm2qtGdUERw2TC +Iy1ttU58sDLK5dy1Igx9SeIPGMHCWemDw4CA0HVaplCIrPkCQQDRWl0HouUquzNd +7i6kk2uNKvj0Hdft5tGNdSk9diJU2d5kLravwXKxq9cFkoZ5g8bgxjGrdnguNO4y +bcv/fN0LAkEAy4tED+0Etg0PLIXuYpHUjy5SGYpykaNx+Rfktv2lF5Uf2aDnh6Pv +DObQEYF1NAZVcT8BsLGKta9RGFL7UJOSmwJAS3fgu2T8abgMH1tCUy+VgNEx54Zu +laM0fWLz1+UjISVc5w5z6s24k9XXcHnOojVf1x17QE03q6iHCYTNGi+f2wJAXgfk +VYclmgTGcccdraO5ErxPaUUwUF+1k2GaY38h+ZcGs79Ftr/g+5DVpoCr6HDUoBB/ +c2VRs0VerWIIf9zs6QJAI0M7qCsyLw9z3wfMt8uZjGLokeSet9+LarJyRFkDVFow +PBHMPvgU1+no5L+4A61cB9azn9zkIvchI2bSG0Ubgg== +-----END RSA PRIVATE KEY----- diff --git a/demos/web/tls/server.pem b/demos/web/tls/server.pem new file mode 100644 index 0000000..7b519f5 --- /dev/null +++ b/demos/web/tls/server.pem @@ -0,0 +1,28 @@ +-----BEGIN CERTIFICATE----- +MIICATCCAWoCCQC0Yl1TUb3gjzANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJB +VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0 +cyBQdHkgTHRkMB4XDTE3MDQzMDE2MDIxNFoXDTI3MDQyODE2MDIxNFowRTELMAkG +A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0 +IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApnSL +fpgnKHKCNypUxedbBMik02B40zlK5jQUqAt8ityNYM4DxZV2pOwS4RLfgDrWfLKV +kOiBL+2iJmNWtc8fcU/4MnhAUCgYXvl+o3yFu8EVOLU+FXhlqJRAJOpqESMVa+II +haXDSuLLnSA0e/UrxhDmWEiTGAkteWPLyEP7G6kCAwEAATANBgkqhkiG9w0BAQsF +AAOBgQAwYgs2CrrCoknDs2p2bS/sEBc/cAWxlB3VA0yQXTAxh+6rLOYLwoF+z92w +IbUhUkZss1r0k7zZDBZ32ZEB6Hc0+q4r599UVV3gF/2Ongc6rvtzJtRAv5EZza0d +l3aaZ0aPu09XuDqv9cb/g+i/L7RgQgoEiEpK60WoTm9FeJ4Fpw== +-----END CERTIFICATE----- +-----BEGIN RSA PRIVATE KEY----- +MIICWwIBAAKBgQCmdIt+mCcocoI3KlTF51sEyKTTYHjTOUrmNBSoC3yK3I1gzgPF +lXak7BLhEt+AOtZ8spWQ6IEv7aImY1a1zx9xT/gyeEBQKBhe+X6jfIW7wRU4tT4V +eGWolEAk6moRIxVr4giFpcNK4sudIDR79SvGEOZYSJMYCS15Y8vIQ/sbqQIDAQAB +AoGAAM7D9oNKfVnA4/+ilas/t9A5bIUlUPEQOfm6t+4GVq4nSXb2cbj98GLs3Ia4 +6uheLhC3xRI7vj3K8aC9xPgSUPpvdqEfef+SlfC7/lcHdtIfz1Fm2qtGdUERw2TC +Iy1ttU58sDLK5dy1Igx9SeIPGMHCWemDw4CA0HVaplCIrPkCQQDRWl0HouUquzNd +7i6kk2uNKvj0Hdft5tGNdSk9diJU2d5kLravwXKxq9cFkoZ5g8bgxjGrdnguNO4y +bcv/fN0LAkEAy4tED+0Etg0PLIXuYpHUjy5SGYpykaNx+Rfktv2lF5Uf2aDnh6Pv +DObQEYF1NAZVcT8BsLGKta9RGFL7UJOSmwJAS3fgu2T8abgMH1tCUy+VgNEx54Zu +laM0fWLz1+UjISVc5w5z6s24k9XXcHnOojVf1x17QE03q6iHCYTNGi+f2wJAXgfk +VYclmgTGcccdraO5ErxPaUUwUF+1k2GaY38h+ZcGs79Ftr/g+5DVpoCr6HDUoBB/ +c2VRs0VerWIIf9zs6QJAI0M7qCsyLw9z3wfMt8uZjGLokeSet9+LarJyRFkDVFow +PBHMPvgU1+no5L+4A61cB9azn9zkIvchI2bSG0Ubgg== +-----END RSA PRIVATE KEY-----