whereisaaron
commented
2 years ago This documentation section seems most relevant:
https://github.com/icing/mod_md#how-to-migrate-a-https-host
It suggests using SSLCertificateFile and SSLCertificateKeyFile instead of MDCertificateFile and MDCertificateKeyFile. But it sounds like it also doesn't address the situation where apache2 will be automatically restarted after a managed certificate is issued, and may still loop in the same way?
The way the example is worded, you have to disable automatic restarts before the managed certificate is issued, then remove the SSLCertificateFile and SSLCertificateKeyFile before apache2 is restarted. I assume it has the same looping problem if the apache2 restart occurs before the SSLCertificateFile and SSLCertificateKeyFile lines are removed?
I think mod_md should realise that if it has a valid managed certificate, that isn't due for renewal, and that it just installed that very session, that it shouldn't try to renew the manual certificate over and over.
I think there should be MDRenewMode setting or other setting that either prefers a managed certificate over a manual one, or prefers the (unexpired) manual or managed certificate that has the newest valid from date/time.
Suggestion 1: Change (fix?) 'MDRenewMode always' behavior or add 'MDRenewMode force'
I expected MDRenewMode always would prefer a managed certificate once issued (whereas manual / auto would not). But if that is not the desired behaviour, I suggest an MDRenewMode force that will always issue a managed certificate, even if a manual one exists, and will prefer to get apache2 to load a valid managed certificate over the manual one (ie. 'force' the issue and use of a managed certificate as soon as possible).
Suggestion 2: Add MDCertificateLoadOrder setting
If the certificate install and loading logic is entirely divorced from renewal, then another option would be to leave MDRenewMode always unchanged but introduce a MDCertificateLoadOrder that determines which certificate to pass to apache2 on start-up if more than one option is available, e.g.
Current behavior, load the manual cert even if a managed one is available
MDCertificateLoadOrder manual,managedOptional new behavior, load a managed cert, even is a manual one is configured
MDCertificateLoadOrder managed,manualMDCertificateLoadOrder would skip the first listed option if that manual/managed certificate does not (yet) exist or has expired.
MDCertificateLoadOrder could have a global default an be used within MDomain/MDomainSet for individual managed domains.
Apache 2.4.54 / mod_md 2.4.17
Is this a bug, or have I got the process wrong?
When I configure
mod_mdwith aMDCertificateFilemanual certificate andMDRenewMode alwaysI expectedmod_mdto eventually renew the certificate and then, after a graceful restart, use that new managed certificate. However, in my testingmod_mdprefers to load the old static certificate in favour of the new certificate it just issued. This triggersmod_mdto enter an endless renewal loop.I'm attempting to perfect the technique to migrate a domain to
mod_mdwithout outage. To achieve this I am employ the following approach.MDCertificateFileand also setMDRenewMode manualmod_md, there is no outage and now HTTP01 challenge renewals are possibleMDRenewMode alwaysto enable automatic renewal when requiredmod_mdissues a new certificate via an HTTP01 challengeMDMessageCmd renewed example.comapache2 performs a graceful restartmod_md/apache2to load the new automatic certificate instead of the old static one, however this is not what happens, insteadmod_md/apache2kept loading the static certificate, then since the static certificate was due for renewal it would loop to issue another new certificate, restarting, loading the old static certificate, etc.Configurations and logs for the steps above below.
The
MDMessageCmdhandler I used is documented in https://github.com/icing/mod_md/issues/298Configuration for (1) a manual certificate with MDCertificateFile and also set MDRenewMode manual
This configuration works fine and I can then switch the DNS record over with zero outage.
Configuration for (3) set 'MDRenewMode always' to enable automatic renewal when required.
I use
MDRenewWindow 90%here to ensure the manual certificate was due for renewal. With this setting the new 90-day certificate would then not be due for renewal for ~9 days.Logs for (4..6):
The following log entries after setting
MDRenewMode alwayslooks perfect,mod_mdsets up a challenge, issues the certificate, signals a graceful restart, then after a restart we seeMDMessageCmd installed example.comwhich suggests the newly issued managed certificate is installed. Themod_mdevents we see are exactly what you'd expect:However... when I check the endpoint with
curlI observe the older manual certificate is still the active one, and when I checkmd-statusis lists the old manual certificate and is busy renewing it again. Checking/etc/apache2/md/domains/example.comthe automatically issued certificate is there inpubcert.pemandprivkey.pembut it is not the one being loaded byapache2.Logs where (6) goes pear-shaped and
mod_mdloops constantly renewing the manual certificateThereafter
mod_mdenters a loop of the following events.Note that I have retries set to
MDRetryDelay 300sthat avoid more than 5 attempts/hour hitting the Let's Encrypt rate limits. However that didn't work here asmod_mdstarted a fresh renewal job after each restart and so triggered with rate limit within 3.5 minutes.Note that on these repeat issuing of the certificate there is no
MDMessageCmd challenge-setup:http-01:example.com example.comas there was for the first renewal. I guess there challenge is the same and already there?Raw logs: