https://upload.beta.wmflabs.org/
Expected behavior: Being able to connect to the domain with a non-expired certificate
What happen instead: I can connect to the domain, but have to accept the expired certificate first.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • bd808 | T273956 acme-chief sometimes doesn't refresh certificates because it ignores SIGHUP | |||
| Resolved | Vgutierrez | T293585 [epic] The SSL certificate for Beta cluster domains fails to properly renew & deploy | |||
| Resolved | Krenair | T267858 The certificate for upload.beta.wmflabs.org expired on November 13, 2020. |
Event Timeline
Comment Actions
Cert was renewed:
root@deployment-acme-chief03:~# openssl x509 -in /var/lib/acme-chief/certs/unified/live/rsa-2048.crt -noout -text | grep After
Not After : Jan 12 05:01:51 2021 GMTAnd the upload cache box has it too:
root@deployment-cache-upload06:~# openssl x509 -in /etc/acmecerts/unified/live/rsa-2048.crt -noout -text | grep After
Not After : Jan 12 05:01:51 2021 GMTMust've not been reloaded by ATS for some reason.
Comment Actions
For some reason I had to do a full restart of the trafficserver-tls service on the cache-upload06 VM but it has loaded the latest cert now:
root@deployment-cache-upload06:~# openssl s_client -connect upload.beta.wmflabs.org:443 2>/dev/null | openssl x509 -noout -text | grep After
Not After : Jan 12 06:00:26 2021 GMTComment Actions
@Vgutierrez FYI in case this could happen in prod too, I haven't been keeping track of changes lately. If we think it won't happen again or won't happen in prod (e.g. maybe it didn't restart because puppet is erroring somewhere in varnish code on this box?) then I guess we can close this
Comment Actions
We haven't experienced this issue in prod, the renewal cycle goes as expected and puppet triggers the reload of trafficserver-tls, but puppet erroring as you mentioned could be causing the issue for you in beta