Custom Xcode 9 Server Certificate

Question

Created Sep ’17

Replies 2

Boosts 0

Views 2.6k

Participants 3

Xcode Server that comes with Xcode 9 now automatically generates SSL certificates for communication between server and clients. It also uses this certificate when communicating with the Xcode Server REST API. Is there a way to specify or replace the autogenerated keys and use a certificate from a trusted third party (like LetsEncrypt)?

The apache configuration file located at

/Library/Developer/XcodeServer/Configuration/httpd_os_xcs.conf

contains this information:

Listen 443
<VirtualHost *:443>
    # Xcode Server uses its own self-signed certificates
    # only if no other SSL configurations for Apache have been found
    <IfModule !ssl_module>
        LoadModule ssl_module libexec/apache2/mod_ssl.so
        SSLEngine on
        SSLCertificateFile /Library/Developer/XcodeServer/Certificates/apache.crt
        SSLCertificateKeyFile /Library/Developer/XcodeServer/Certificates/apache.key
    </IfModule>
    [...]
    <IfModule mod_proxy.c>
        SSLProxyEngine On
        SSLProxyCheckPeerCN Off
        ProxyPass /xcode/internal/api https://127.0.0.1:20343/api retry=0 timeout=30
        ProxyPassReverse /xcode/internal/api https://127.0.0.1:20343/api
        ProxyPass /xcode/internal/socket.io https://127.0.0.1:20343/socket.io retry=0 timeout=30
        ProxyPassReverse /xcode/internal/socket.io https://127.0.0.1:20343/socket.io
    </IfModule>
    [...]
</VirtualHost>

I believe the certificate is also part of the apache.keychain file found at

/Library/Developer/XcodeServer/Keychains/apache.keychain

but I haven't been able to verify that.

Every time the Xcode Server service is started in Xcode, the apache.{crt/key} files as well as the httpd_os_xcs.conf files are overwritten, so simple replacing/modifying these files does not appear to be an option.

The only way forward I can see is to implement some other SSL configuration as suggested in the http_os_xcs.conf file, but I can't seem to get that to work either.

Any suggestions or solutions are greatly appreciated.

Boost

Answer 1

JacobGorban OP

Oct ’17

I have the same problem, was trying to understand how to use a custom certificate since the "Unsecure Connection" warning in browsers is not fun.

0

Answer 2

MacBlazer2 OP

Dec ’17

Xcode 9 Server starts up Apache using the configuration from /etc/apache2

$ ls -al /etc/apache2/other
total 8
drwxr-xr-x   4 root  wheel  136 Dec 21 10:30 .
drwxr-xr-x  11 root  wheel  374 May 15  2017 ..
lrwxr-xr-x   1 root  wheel   62 Dec 21 10:30 httpd_xcs.conf -> /Library/Developer/XcodeServer/Configuration/httpd_os_xcs.conf
-r--r--r--   1 root  wheel  194 Feb  6  2017 php5.conf

In particular, if the /etc/apache2/httpd.conf file enables the ssl_module and specifies the certificate information before loading the other/*.conf files (happens at the last line of the httpd.conf file), then the Xcode Server certificate is not used.

0