search

hacklab-fi / itinfra

Document hacklab.fi common use infra
MIT License
3 stars 3 forks source link

Nginx on sso machine sometimes fails with cert after reboot #24

Closed tswfi closed 11 months ago

tswfi commented 11 months ago

Can't remember the exact details right now, but something about the restart starts services in an order where nginx wont handle ssl cert correctly (maybe dns doesn't resolve when nginx starts?)

This causes firefox to show Mozilla_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING error.

restarting nxingx fixes the problem.

tswfi commented 11 months ago

@olmari do you have more details for this?

olmari commented 11 months ago

Needs unit file override for starting after Named (so resolver is available) which is needed for proper SSL-cert staple response.

There is still change to this exact error coming once after some reboot or some large amount of time passing, but that is kind of separate issue, even when causes are pretty much because of same "services".

olmari commented 11 months ago

Added unit-file override to start after DNS-resolver