processone / processone/ejabberd
Certificate is not loaded after config reload
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 6.7k
- Forks
- 1.6k
- PR merge metrics
- No merged PRs in 30d
Description
Before creating a ticket, please consider if this should fit the discussion forum better.
Environment
- ejabberd version: 23.01
- Erlang version: Erlang (SMP,ASYNC_THREADS) (BEAM) emulator version 12.3.1
- OS: Red Hat Enterprise Linux 8.5
- Installed from: official rpm
Bug description
Reload of certificate from valid to invalid seems not working.
- I have configured certfile: "/opt/ejabberd/conf/lx-rec-fss-01-ejabberd.pem" where pem file was issued for different host
-> Ejabberd was started with this config and behavior is OK. Service is running and when reaching Admin UI then secure connection is not established "NET::ERR_CERT_COMMON_NAME_INVALID" - Changed certificate "/opt/ejabberd/conf/lx-rec-fss-01-ejabberd.pem" to the correct one (rename invalid cert to different name and rename proper cert tolx-rec-fss-01-ejabberd.pem )
->Config was reloaded and new valid cert is accepted. When reaching Admin UI then secure connection is established. - Changed certificate again to invalid one and reload config.
-> No impact, ejabberd is still using cert from step 2
ejabberd.zip
I expect that once cert is updated although to wrong one, this one is used and not previous cached one.
Thank you.
BR,
Marek
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file, test, or entry point is named. Reproduce the three-step certificate replacement and configuration reload using the attached ejabberd.zip and the stated ejabberd 23.01 environment, then trace certificate loading during reload. Done means the newly replaced certificate, including an invalid one, is used after reload rather than the previously cached certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100