This PR alters certificate refreshing to make it no longer regenerate the
SSH key pair every time. It adds a config parameter ssh.cert_key_ttl (default
86400) for the lifetime in seconds of a key pair. Set to 0 for the key pair
never to expire or -1 for it to be regenerated every time the certificate is
refreshed. This can be overridden in the environment variable
PLATFORMSH_CLI_SSH_CERT_KEY_TTL.
This PR also ensures that new keys are written (or rather, renamed into
place) much closer to the time of saving the new certificate.
These changes will reduce the chance of a key pair being regenerated while it is
being read by another program (like SSH), for example if an SSH connection is
made at exactly the same time as another CLI process that is refreshing the
certificate. Three files are being saved (or now, renamed) - the certificate,
private key, and public key - which leaves the unfortunate possibility that SSH
may read the old version of one file and find it conflicts with another file.
This seems to happen more often than one might expect.
This PR alters certificate refreshing to make it no longer regenerate the SSH key pair every time. It adds a config parameter
ssh.cert_key_ttl(default 86400) for the lifetime in seconds of a key pair. Set to 0 for the key pair never to expire or -1 for it to be regenerated every time the certificate is refreshed. This can be overridden in the environment variablePLATFORMSH_CLI_SSH_CERT_KEY_TTL.This PR also ensures that new keys are written (or rather, renamed into place) much closer to the time of saving the new certificate.
These changes will reduce the chance of a key pair being regenerated while it is being read by another program (like SSH), for example if an SSH connection is made at exactly the same time as another CLI process that is refreshing the certificate. Three files are being saved (or now, renamed) - the certificate, private key, and public key - which leaves the unfortunate possibility that SSH may read the old version of one file and find it conflicts with another file. This seems to happen more often than one might expect.