배경
언제나 그렇듯, 삽질은 예상치 못한 곳에서 시작된다. 지금 다루고 있는 프로젝트는 K8s에서 5G를 프로비저닝 해주는 서비스이다. 근데 이걸 사용하려면 웹 인터페이스가 필요한데, 문제는 해당 서비스에는 SSL이 없다.
그래서, Nginx의 reverse proxy 를 통해서 외부로 HTTPS 노출을 시키고, 머신 내부에서는 kubectl port-forward로 하려고 한다. 하지만.... certbot을 사용해서 SSL을 만드려 하니 에러가 나왔다.
역시나 그렇듯, 언제나 SSL은 발목을 잡는다..
문제점
그냥 쉬운 커맨드였다.
$ sudo certbot certonly
Traceback (most recent call last):
File "/usr/bin/certbot", line 11, in <module>
load_entry_point('certbot==0.40.0', 'console_scripts', 'certbot')()
File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 490, in load_entry_point
return get_distribution(dist).load_entry_point(group, name)
File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2854, in load_entry_point
return ep.load()
File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2445, in load
return self.resolve()
File "/usr/lib/python3/dist-packages/pkg_resources/__init__.py", line 2451, in resolve
module = __import__(self.module_name, fromlist=['__name__'], level=0)
File "/usr/lib/python3/dist-packages/certbot/main.py", line 10, in <module>
import josepy as jose
File "/usr/lib/python3/dist-packages/josepy/__init__.py", line 41, in <module>
from josepy.interfaces import JSONDeSerializable
File "/usr/lib/python3/dist-packages/josepy/interfaces.py", line 7, in <module>
from josepy import errors, util
File "/usr/lib/python3/dist-packages/josepy/util.py", line 7, in <module>
import OpenSSL
File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module>
from OpenSSL import crypto, SSL
File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1553, in <module>
class X509StoreFlags(object):
File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1573, in X509StoreFlags
CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
해결
sudo rm -rf /usr/lib/python3/dist-packages/OpenSSL
sudo pip3 install pyopenssl
sudo pip3 install pyopenssl --upgrade
sudo pip3 install urllib3==1.26.15 requests-toolbelt==0.10.1이러면 아마, 될 것이다!
sudo certbot certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log
How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
