Security certificate issue

[russell]

Hi Chris,

I'm having trouble browsing to the stage site today on crin4 - I'm getting:

SEC_ERROR_EXPIRED_CERTIFICATE

.. trying to view stage.crin.org

Are you able to help there?

Many thanks,
Russell

[chris]

I think the problem was that Nginx needs a restart before a new cert is used and the Let's Encryypt certs are only valid for three months, I have restarted Nginx and it looks OK:

• ​https://www.ssllabs.com/ssltest/analyze.html?d=dev.crin.org

I have added this root crontab:

# restart nginx as certbot doesn't
01 01 01 * * service nginx restart

If/when I rebuild the servers with Debian stretch then I'd switch to using acme.sh for the certs as it can also restart services:

• ​https://github.com/Neilpang/acme.sh

[russell]

Thanks Chris

[russell]

Hi Chris,

It looks a bit like this has happened again:

dev.crin.org uses an invalid security certificate. The certificate expired on 22 April 2017 00:02. The current time is 25 April 2017 11:30. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Do we think that restart's not sorting it out?

Thanks,
Russell

[chris]

Sorry about this, a nginx restart has solved the problem, the crontab was set to run on the first of each month, I have changed this to every night, which isn't a perfect solution but should work.

[russell]

Hi Chris,

I'm seeing that expired certificate again, would we expect that to roll round on cron tonight?

Thanks,
Russell

[chris]

I restarted Nginx and it is OK now:

• ​https://www.ssllabs.com/ssltest/analyze.html?d=dev.crin.org

I'm not sure why this root crontab isn't doing the trick:

01 01 * * * service nginx restart

I should probably switch the server over to use acme.sh:

• ​https://github.com/Neilpang/acme.sh

[russell]

Thanks Chris,

We seem to have a very old version of the dev. site there, presume that's from the DB recovery. I'll resync dev from live and rebuild.

[russell]

prod > dev DB sync underway.

It will take a long time.

[chris]

This issue still hasn't been solved, I have just restarted Nginx to solve it for the next 6 weeks...