search

glatzert / ACME-Server-ADCS

ACME (RFC 8555) Server compatible implementation, connecting to Active Directory Certificate Services (ADCS)
Other
90 stars 13 forks source link

Challenge Validation and Issuance Timing #28

Open rebortg opened 6 months ago

rebortg commented 6 months ago

Hey,

i try to get the certificates with traefik and its acme provider. They have a hardcoded 30 sec timeout. My installation take between 40 and 60 sec. to successfully rollout a Certificate.

Is this time "normal" or should i debug my Infrastructure. And if yes on which parts should is look? Webserver for ACME service or the Issueing CA? The Server are all on the same Switch, so also no Delay on the Wire.

glatzert commented 6 months ago

The implementation of validating the challenge is timer based. The server will essentially check every minute, if something is to do.

You can reduce the polling intervals via config file (see here https://github.com/glatzert/ACME-Server-ADCS/blob/main/src/ACME.Server.ADCS/appsettings-sample.json)

Also it'd probably a good enhancement, to "real time validate" if possible.

rebortg commented 6 months ago

this worked like charm, thnak you very much for quick response.

glatzert commented 6 months ago

I'm using this to track "real-time issuance".

Plan would be to implement a channel (producer / consumer pattern implementation in .NET), that automatically adds orders to validate and issuance respectively. A "backup" is needed in case the server restarts to pick up orders that have not yet been validated or isseud (depending on their state).