CRIN Trac: Ticket #102: Security certificate issue

component changed

russell — Fri, 10 Mar 2017 12:30:42 GMT

component changed from backups to crin4

hours changed; totalhours set

chris — Fri, 10 Mar 2017 12:47:03 GMT

hours changed from 0 to 0.25
totalhours set to 0.25

I think the problem was that Nginx needs a restart before a new cert is used and the Let's Encryypt certs are only valid for three months, I have restarted Nginx and it looks OK:

https://www.ssllabs.com/ssltest/analyze.html?d=dev.crin.org

I have added this root crontab:

# restart nginx as certbot doesn't
01 01 01 * * service nginx restart

If/when I rebuild the servers with Debian stretch then I'd switch to using acme.sh for the certs as it can also restart services:

https://github.com/Neilpang/acme.sh

russell — Fri, 10 Mar 2017 13:00:24 GMT

Thanks Chris

russell — Tue, 25 Apr 2017 10:36:35 GMT

Hi Chris,

It looks a bit like this has happened again:

dev.crin.org uses an invalid security certificate. The certificate expired on 22 April 2017 00:02. The current time is 25 April 2017 11:30. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Do we think that restart's not sorting it out?

Thanks, Russell

hours, totalhours changed

chris — Tue, 25 Apr 2017 10:56:44 GMT

hours changed from 0 to 0.15
totalhours changed from 0.25 to 0.4

Sorry about this, a nginx restart has solved the problem, the crontab was set to run on the first of each month, I have changed this to every night, which isn't a perfect solution but should work.

russell — Fri, 23 Jun 2017 13:55:17 GMT

Hi Chris,

I'm seeing that expired certificate again: https://dev.crin.org/

Would we expect that to roll round on cron tonight?

Thanks, Russell

hours, totalhours changed

chris — Fri, 23 Jun 2017 14:07:21 GMT

hours changed from 0 to 0.25
totalhours changed from 0.4 to 0.65

I restarted Nginx and it is OK now:

https://www.ssllabs.com/ssltest/analyze.html?d=dev.crin.org

I'm not sure why this root crontab isn't doing the trick:

01 01 * * * service nginx restart

I should probably switch the server over to use acme.sh:

https://github.com/Neilpang/acme.sh

russell — Fri, 23 Jun 2017 14:13:10 GMT

Thanks Chris,

We seem to have a very old version of the dev. site there, presume that's from the DB recovery. I'll resync dev from live and rebuild.

russell — Fri, 23 Jun 2017 14:19:32 GMT

prod > dev DB sync underway.

It will take a long time.

hours, totalhours changed

chris — Wed, 23 Aug 2017 16:38:50 GMT

hours changed from 0 to 0.25
totalhours changed from 0.65 to 0.9

This issue still hasn't been solved, I have just restarted Nginx to solve it for the next 6 weeks...