Generate a self-signed SSL certificate

There are a lot of tutorials to generate a SSL certificate, like this one, or this other one. But you will see that there are a few steps to respect in order to make it work properly.

When I released my docker mail server, I wanted to create an easy way to do complicated things. So I wrote a tool to simplify the process of self-signed ssl certificates. This tool is built-in docker mail server.

How can I generate my self-signed certificate?

You just need to have docker installed on your computer. Just type the following command line:

docker run -ti --rm -v "$(pwd)":/ssl -h mail.my-domain.com -t tvial/docker-mailserver generate-ssl-certificate

Don't forget to change mail.my-domain.com to your real Fully Qualified Domain Name (FQDN). You will be asked some informations about your name, company, location... When asked, sign the certificate.

It will generate some files needed for your SSL configuration (postfix, nginx, apache...).

mail.my-domain.com-key.pem (private key)
mail.my-domain.com-req.pem (public key)
mail.my-domain.com-cert.pem (certificate)
mail.my-domain.com-combined.pem (private key + certificate)
demoCA/cacert.pem (certificate authority)

Now you need to configure your daemon to use this certificate and you have a fully SSL secured connection available.

26August

read

GZip compression with official nginx docker image

Show Comments Thomas VIAL

For a better experience, I wanted to improve the performance of this blog. I combined/minified css/js files, but I saw that these assets were not compressed.

# Call without gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent --write-out "%{size_download}\n" --output /dev/null
119887

# Call with gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent -H "Accept-Encoding: gzip,deflate" --write-out "%{size_download}\n" --output /dev/null
119887

The size remains the same.

It was strange because I worked with my configurations files before I move to docker.

I thought that the official nginx image was compiled without gzip module. But it is:

$ docker run nginx nginx -V
nginx version: nginx/1.9.0
built by gcc 4.9.2 (Debian 4.9.2-10)
built with OpenSSL 1.0.1k 8 Jan 2015
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-threads --with-stream --with-stream_ssl_module --with-mail --with-mail_ssl_module --with-file-aio --with-http_spdy_module --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed' --with-ipv6

As you can see, --with-http_gzip_static_module is here.

So where is the problem?

Well I found that adding gzip_http_version 1.0; to nginx.conf solves the problem (default value is 1.1).

# Call without gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent --write-out "%{size_download}\n" --output /dev/null
119887

# Call with gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent -H "Accept-Encoding: gzip,deflate" --write-out "%{size_download}\n" --output /dev/null
34441

As you can see, the asset is now gziped and lighter.

Show Comments Thomas VIAL

There are a lot of tutorials to generate a SSL certificate, like this one, or this other one. But you will see that there are a few steps to respect in order to make it work properly.

How can I generate my self-signed certificate?

You just need to have docker installed on your computer. Just type the following command line:

docker run -ti --rm -v "$(pwd)":/ssl -h mail.my-domain.com -t tvial/docker-mailserver generate-ssl-certificate

It will generate some files needed for your SSL configuration (postfix, nginx, apache...).

mail.my-domain.com-key.pem (private key)
mail.my-domain.com-req.pem (public key)
mail.my-domain.com-cert.pem (certificate)
mail.my-domain.com-combined.pem (private key + certificate)
demoCA/cacert.pem (certificate authority)

Now you need to configure your daemon to use this certificate and you have a fully SSL secured connection available.

Show Comments Thomas VIAL

For a better experience, I wanted to improve the performance of this blog. I combined/minified css/js files, but I saw that these assets were not compressed.

# Call without gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent --write-out "%{size_download}\n" --output /dev/null
119887

# Call with gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent -H "Accept-Encoding: gzip,deflate" --write-out "%{size_download}\n" --output /dev/null
119887

The size remains the same.

It was strange because I worked with my configurations files before I move to docker.

I thought that the official nginx image was compiled without gzip module. But it is:

$ docker run nginx nginx -V
nginx version: nginx/1.9.0
built by gcc 4.9.2 (Debian 4.9.2-10)
built with OpenSSL 1.0.1k 8 Jan 2015
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-threads --with-stream --with-stream_ssl_module --with-mail --with-mail_ssl_module --with-file-aio --with-http_spdy_module --with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,--as-needed' --with-ipv6

As you can see, --with-http_gzip_static_module is here.

So where is the problem?

Well I found that adding gzip_http_version 1.0; to nginx.conf solves the problem (default value is 1.1).

# Call without gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent --write-out "%{size_download}\n" --output /dev/null
119887

# Call with gzip
➜  ~  curl http://tvi.al/assets/js/tvi.al.min.js\?v\=8419b36904 --silent -H "Accept-Encoding: gzip,deflate" --write-out "%{size_download}\n" --output /dev/null
34441

As you can see, the asset is now gziped and lighter.

Tag: nginx

Generate a self-signed SSL certificate