processone / processone/ejabberd

Certificate is not loaded after config reload

Open
#4,007 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Erlang
Stars
6.7k
Forks
1.6k
PR merge metrics
No merged PRs in 30d

Description

Before creating a ticket, please consider if this should fit the discussion forum better.

Environment

  • ejabberd version: 23.01
  • Erlang version: Erlang (SMP,ASYNC_THREADS) (BEAM) emulator version 12.3.1
  • OS: Red Hat Enterprise Linux 8.5
  • Installed from: official rpm

Bug description

Reload of certificate from valid to invalid seems not working.

  1. I have configured certfile: "/opt/ejabberd/conf/lx-rec-fss-01-ejabberd.pem" where pem file was issued for different host
    -> Ejabberd was started with this config and behavior is OK. Service is running and when reaching Admin UI then secure connection is not established "NET::ERR_CERT_COMMON_NAME_INVALID"
  2. Changed certificate "/opt/ejabberd/conf/lx-rec-fss-01-ejabberd.pem" to the correct one (rename invalid cert to different name and rename proper cert tolx-rec-fss-01-ejabberd.pem )
    ->Config was reloaded and new valid cert is accepted. When reaching Admin UI then secure connection is established.
  3. Changed certificate again to invalid one and reload config.
    -> No impact, ejabberd is still using cert from step 2
    ejabberd.zip

I expect that once cert is updated although to wrong one, this one is used and not previous cached one.

Thank you.
BR,
Marek

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is named. Reproduce the three-step certificate replacement and configuration reload using the attached ejabberd.zip and the stated ejabberd 23.01 environment, then trace certificate loading during reload. Done means the newly replaced certificate, including an invalid one, is used after reload rather than the previously cached certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.