search

colin-stubbs / dehydrated-bigip

F5 BIG-IP hook for dehydrated based Let's Encrypt interactions
GNU General Public License v3.0
10 stars 1 forks source link

cert deploy fails if re-keyed #11

Open Sander-agfa opened 5 years ago

Sander-agfa commented 5 years ago

A certificate (re-)deploy fails if the key has changed, and certificate filename timestamping is disabled. this bug can be worked around if you enable timestamping on the certificate filenames, or if you temporarily delete/set another certificate/key in the active profile.

Error Received from the REST call:

02/19/2019:10:02:09 restCall():/usr/bin/curl -sk --connect-timeout 5 -m 120 -H Content-Type: application/json --user letsencrypt: https:///mgmt/tm/sys/crypto/key -X POST -d "{ "command": "install", "name": "/Common/HOSTNAMEHEREkey", "from-local-file": "/var/config/rest/downloads/HOSTNAMEHERE.key", "securityType": "normal" }" 02/19/2019:10:02:10 createCertFromUpload()[Write Back Results]: { "apiError": 3, "code": 400, "errorStack": [], "message": "01070317:3: profile /Common/HOSTNAMEHERE's key and certificate do not match" }

Sander-agfa commented 5 years ago

Latest commit in #10 Fixes this issue. Adds the timestamp once, even if timestamping is disabled if it detects this "key and cert do not match" error.