Open whereisaaron opened 1 year ago
This documentation section seems most relevant:
https://github.com/icing/mod_md#how-to-migrate-a-https-host
It suggests using SSLCertificateFile
and SSLCertificateKeyFile
instead of MDCertificateFile
and MDCertificateKeyFile
. But it sounds like it also doesn't address the situation where apache2
will be automatically restarted after a managed certificate is issued, and may still loop in the same way?
The way the example is worded, you have to disable automatic restarts before the managed certificate is issued, then remove the SSLCertificateFile
and SSLCertificateKeyFile
before apache2
is restarted. I assume it has the same looping problem if the apache2
restart occurs before the SSLCertificateFile
and SSLCertificateKeyFile
lines are removed?
I think mod_md
should realise that if it has a valid managed certificate, that isn't due for renewal, and that it just installed
that very session, that it shouldn't try to renew the manual certificate over and over.
I think there should be MDRenewMode
setting or other setting that either prefers a managed certificate over a manual one, or prefers the (unexpired) manual or managed certificate that has the newest valid from date/time.
I expected MDRenewMode always
would prefer a managed certificate once issued (whereas manual
/ auto
would not). But if that is not the desired behaviour, I suggest an MDRenewMode force
that will always issue a managed certificate, even if a manual one exists, and will prefer to get apache2
to load a valid managed certificate over the manual one (ie. 'force' the issue and use of a managed certificate as soon as possible).
If the certificate install and loading logic is entirely divorced from renewal, then another option would be to leave MDRenewMode always
unchanged but introduce a MDCertificateLoadOrder
that determines which certificate to pass to apache2
on start-up if more than one option is available, e.g.
Current behavior, load the manual cert even if a managed one is available
MDCertificateLoadOrder manual,managed
Optional new behavior, load a managed cert, even is a manual one is configured
MDCertificateLoadOrder managed,manual
MDCertificateLoadOrder
would skip the first listed option if that manual/managed certificate does not (yet) exist or has expired.
MDCertificateLoadOrder
could have a global default an be used within MDomain/MDomainSet
for individual managed domains.
Apache 2.4.54 / mod_md 2.4.17
Is this a bug, or have I got the process wrong?
When I configure
mod_md
with aMDCertificateFile
manual certificate andMDRenewMode always
I expectedmod_md
to eventually renew the certificate and then, after a graceful restart, use that new managed certificate. However, in my testingmod_md
prefers to load the old static certificate in favour of the new certificate it just issued. This triggersmod_md
to enter an endless renewal loop.I'm attempting to perfect the technique to migrate a domain to
mod_md
without outage. To achieve this I am employ the following approach.MDCertificateFile
and also setMDRenewMode manual
mod_md
, there is no outage and now HTTP01 challenge renewals are possibleMDRenewMode always
to enable automatic renewal when requiredmod_md
issues a new certificate via an HTTP01 challengeMDMessageCmd renewed example.com
apache2 performs a graceful restartmod_md
/apache2
to load the new automatic certificate instead of the old static one, however this is not what happens, insteadmod_md
/apache2
kept loading the static certificate, then since the static certificate was due for renewal it would loop to issue another new certificate, restarting, loading the old static certificate, etc.Configurations and logs for the steps above below.
The
MDMessageCmd
handler I used is documented in https://github.com/icing/mod_md/issues/298Configuration for (1) a manual certificate with MDCertificateFile and also set MDRenewMode manual
This configuration works fine and I can then switch the DNS record over with zero outage.
Configuration for (3) set 'MDRenewMode always' to enable automatic renewal when required.
I use
MDRenewWindow 90%
here to ensure the manual certificate was due for renewal. With this setting the new 90-day certificate would then not be due for renewal for ~9 days.Logs for (4..6):
The following log entries after setting
MDRenewMode always
looks perfect,mod_md
sets up a challenge, issues the certificate, signals a graceful restart, then after a restart we seeMDMessageCmd installed example.com
which suggests the newly issued managed certificate is installed. Themod_md
events we see are exactly what you'd expect:However... when I check the endpoint with
curl
I observe the older manual certificate is still the active one, and when I checkmd-status
is lists the old manual certificate and is busy renewing it again. Checking/etc/apache2/md/domains/example.com
the automatically issued certificate is there inpubcert.pem
andprivkey.pem
but it is not the one being loaded byapache2
.Logs where (6) goes pear-shaped and
mod_md
loops constantly renewing the manual certificateThereafter
mod_md
enters a loop of the following events.Note that I have retries set to
MDRetryDelay 300s
that avoid more than 5 attempts/hour hitting the Let's Encrypt rate limits. However that didn't work here asmod_md
started a fresh renewal job after each restart and so triggered with rate limit within 3.5 minutes.Note that on these repeat issuing of the certificate there is no
MDMessageCmd challenge-setup:http-01:example.com example.com
as there was for the first renewal. I guess there challenge is the same and already there?Raw logs: