From f787449cc955373d78752d54a5f9b49fbaf4276f Mon Sep 17 00:00:00 2001 From: turegjorup Date: Mon, 14 Sep 2026 15:20:59 +0200 Subject: [PATCH 1/2] docs: fix SSL cert paths and cover both mac architectures The certificate path read ./treafik/ssl/, and the openssl config path was the Intel Homebrew prefix, which does not exist on Apple Silicon. Derive it from openssl version -d so one command covers both. Note that the wildcard only covers one level, and that a double wildcard is not a way around it. --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9bdaa3bd..47006118 100644 --- a/README.md +++ b/README.md @@ -115,13 +115,19 @@ This setup comes with self-signed wildcard certificates for *.local.itkdev.dk, b by using this openssl command on Mac, just change the two places where the domain is written. ```sh -openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout docker.key -out docker.crt -subj "/CN=*.local.itkdev.dk" -reqexts SAN -extensions SAN -config <(cat /usr/local/etc/openssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:*.local.itkdev.dk')) +openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout docker.key -out docker.crt -subj "/CN=*.local.itkdev.dk" -reqexts SAN -extensions SAN -config <(cat "$(openssl version -d | cut -d'"' -f2)/openssl.cnf" <(printf '[SAN]\nsubjectAltName=DNS:*.local.itkdev.dk')) ``` +`openssl version -d` finds the config wherever Homebrew put it, on Intel (`/usr/local`) as well as Apple Silicon +(`/opt/homebrew`). + +The wildcard covers one level only, so `foo.local.itkdev.dk` matches but `foo.bar.local.itkdev.dk` does not. Add a +`DNS:` entry per level you need; a double wildcard, `*.*.local.itkdev.dk`, matches nothing at all. + To mac browser trust this certificate you need to open it with key-chain right click and select "Get info" and then open the "Trust" tab and select "Always trust". -The certificate is located in `./treafik/ssl/docker.crt` in this repository. +The certificate is located in `./traefik/ssl/docker.crt` in this repository. ## Completions From 994a6c25322322f37e844b0dd0391b1b62db7a52 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Mon, 14 Sep 2026 15:21:35 +0200 Subject: [PATCH 2/2] docs: add changelog entry for PR-151 --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 66a125fd..87a3dd12 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ Changelog", this file is a reverse-chronological list of merged pull requests. ## Open PR's +- [PR-151](https://github.com/itk-dev/devops_itkdev-docker/pull/151) - 2026-09-14 - + Fixed the SSL section of the README: the certificate path read `treafik`, + and the `openssl` config path was the Intel Homebrew prefix, so the + documented command failed on Apple Silicon - [PR-145](https://github.com/itk-dev/devops_itkdev-docker/pull/145) - 2026-07-08 - Updated GitHub Actions to latest versions (`actions/checkout` to `v7`, `go-task/setup-task` to `v2`) in workflow templates and repository CI