auto-ssl / auto-ssl/lua-resty-auto-ssl
Strange issue when fullcert_pem cert is expired but cert_pem renewed
- Dominant language
- Lua
- Stars
- 2k
- Forks
- 184
- PR merge metrics
- No merged PRs in 30d
Description
Hi
We use the redis storage for certificates.
We were moving servers by switching dns from one environment to another that work with the same redis server. This was on the day the certificate for that domain was supposed to expire.
We started getting expired certificate errors when trying to access the subdomain.
Debugging the redis record, it appeared that fullcert_pem for a given subdomain was expired (didn't renew) but the cert_pem was valid (with valid exp date).
Any idea how that could happen? I tried to figure out following the code how such state could happen.
From what I see the renewal function always saves both of them, the fullcert_pem and the cert_pem.
Thanks.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the renewal function and the Redis record handling for fullcert_pem and cert_pem. Reproduce the reported state around certificate expiry, then identify how the values diverge and verify that the resulting certificate served for the subdomain remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx, redis
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100