A way to control whether cockpit-ws can change permissions on certificates files.

[cjsthompson]

I put some symlinks to the certificates for my server in /etc/cockpit/ws-certs.d. Works great. However when cockpit-ws is started it always changes the permissions to 640 and changes the group ownership of the symlinked certificate files to the cockpit-ws group. But nginx and opensmtpd also use those same certs. When I restart my server then nginx and opensmtpd can't access the certs anymore and won't start. I don't want to do the dance of manually copying certificate files for every service that uses them every year when I renew the certs because I'll have forgotten by then and things will go wrong and I will wonder why. So it would be nice to be able to disable this behavior.

[JoeDat]

I can reproduce this issue. Submitted a Bugzilla report before finding this reported in Github. I'd argue this is less an enhancement than it is a design defect and issue (and therefore, afforded a higher priority), specifically for the reasons @cjsthompson stated above. Workarounds involve either duplication, of which it's easy to lose track, or making the files immutable, which involves unnecessary complexity in automated renewal processes (ie, via Certbot). All of this can lead to service outages, avoidable by passing the responsibilities to the server administrator to ensure file permissions and ownership are proper (which is really where they belong).

[marusak]

@martinpitt Was this issue fixed with #15321 ?

[martinpitt]

Exactly, and moreover, shared certificates are now officially supported, see https://cockpit-project.org/blog/cockpit-257.html

[cjsthompson]

Thanks for fixing this!