X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/125dd3b1e5f34156b002951f504f5346cc5d7e8d..6c2982563145e00afcba6c7eeedc2b600232e48f:/doc/_includes/_install_custom_certificates.liquid
diff --git a/doc/_includes/_install_custom_certificates.liquid b/doc/_includes/_install_custom_certificates.liquid
index 74bc009b89..da6725976f 100644
--- a/doc/_includes/_install_custom_certificates.liquid
+++ b/doc/_includes/_install_custom_certificates.liquid
@@ -4,9 +4,19 @@ Copyright (C) The Arvados Authors. All rights reserved.
SPDX-License-Identifier: CC-BY-SA-3.0
{% endcomment %}
-If you plan to use custom certificates, please set the variable USE_LETSENCRYPT=no and copy your certificates to the directory specified with the variable @CUSTOM_CERTS_DIR@ (usually "./certs") in the remote directory where you copied the @provision.sh@ script. From this dir, the provision script will install the certificates required for the role you're installing.
+Copy your certificates to the directory specified with the variable @CUSTOM_CERTS_DIR@ in the remote directory where you copied the @provision.sh@ script. The provision script will find the certificates there.
-The script expects cert/key files with these basenames (matching the role except for keepweb, which is split in both download / collections):
+For a @single hostname@ setup, the certificate and its key need to be copied to a file named after @HOSTNAME_EXT@.
+
+For example, if @HOSTNAME_EXT@ is defined as @my-arvados.example.net@, the script will look for
+
+
+
+
+
+For a @multiple hostnames@ setup, the script expects cert/key files with these basenames (matching the role except for keepweb, which is split in both download / collections):
* "controller"
* "websocket"
@@ -17,10 +27,14 @@ The script expects cert/key files with these basenames (matching the role except
* "collections" # Part of keepweb
* "keepproxy"
-Ie., for 'keepproxy', the script will lookup for
+E.g. for 'keepproxy', the script will look for
+
+All certificate files will be used by nginx. You may need to include intermediate certificates in your certificate files. See "the nginx documentation":http://nginx.org/en/docs/http/configuring_https_servers.html#chains for more details.
+
+Make sure that all the FQDNs that you will use for the public-facing applications (API/controller, Workbench, Keepproxy/Keepweb) are reachable.