CA Root expired on 30 May 2020 • Hacker News Board

Re: CA Root expired on 30 May 2020

#151

Post by Sebb767 » Mon, Jun 01, 2020, 11:29 AM UTC

amaccuish wrote: post #135

Sebb767 wrote: post #96

Earlier quoted context omitted.

Me too! Especially with the short expiration times of LetsEncrypt. But I really don't want to put `nginx -s reload` in the Cron, in case I'm tinkering with the configs and they're suddenly live (which only really happens at staging or at home of course, but still).

Certbot has deploy hooks which is where I'd put the nginx reload statement. The hooks are run automatically when a new certificate is issued.

Oh, that's a great idea! Thanks :)

Re: CA Root expired on 30 May 2020

#152

Post by Sebb767 » Mon, Jun 01, 2020, 11:31 AM UTC

emilburzo wrote: post #129

Sebb767 wrote: post #96

Earlier quoted context omitted.

Me too! Especially with the short expiration times of LetsEncrypt. But I really don't want to put `nginx -s reload` in the Cron, in case I'm tinkering with the configs and they're suddenly live (which only really happens at staging or at home of course, but still).

You can use `nginx -t && nginx -s reload` for that. It will first check the configs/paths, and only then, if successful, signal nginx to reload.

That's what I usually do. My problem is that I might be adding a location and nginx reloads between that and adding access restrictions (i.e. because I took a break to google).

Re: CA Root expired on 30 May 2020

#153

Post by spleen » Tue, Jun 02, 2020, 7:49 AM UTC

aarbor989 wrote: post #140

We had to get an entirely new certificate to resolve this. We had recently migrated our docker images to be based on Amazon Linux 2, and low a behold, there was no easy way we found to upgrade to the required version of OpenSSL on Amazon Linux 2. Was easier to just upgrade our certificates

This workaround fixed the problem on our servers: https://forums.aws.amazon.com/thread.jspa?messageID=945042&t...

Re: CA Root expired on 30 May 2020

#154

Post by kbenson » Wed, Jun 03, 2020, 8:52 PM UTC

mshade wrote: post #75

mehrdadn wrote: post #63

Earlier quoted context omitted.

Is that a cURL bug?

It seems only to be older versions of curl or curl with openssl <= 1.1.1. My macbook's curl fails, but my arch linux box's curl works fine.

My guess is openssl, since we experienced this problem with a lot of our internal services and our monitoring, both of which make heavy use of Perl and LWP::UserAgent, which build on OpenSSL. CentOS 7 boxes had problems (easily shown through the lwp-request util, which can often be used like curl's CLI tool), but not on CentOS 8.