auto-ssl / auto-ssl/lua-resty-auto-ssl

Strange issue when fullcert_pem cert is expired but cert_pem renewed

Open
#112 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

Hi
We use the redis storage for certificates.
We were moving servers by switching dns from one environment to another that work with the same redis server. This was on the day the certificate for that domain was supposed to expire.
We started getting expired certificate errors when trying to access the subdomain.
Debugging the redis record, it appeared that fullcert_pem for a given subdomain was expired (didn't renew) but the cert_pem was valid (with valid exp date).
Any idea how that could happen? I tried to figure out following the code how such state could happen.
From what I see the renewal function always saves both of them, the fullcert_pem and the cert_pem.
Thanks.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the renewal function and the Redis record handling for fullcert_pem and cert_pem. Reproduce the reported state around certificate expiry, then identify how the values diverge and verify that the resulting certificate served for the subdomain remains valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx, redis
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.