X.509 certificate reloading

[defanor]

It would be nice to be able to reload X.509 certificates without
restarting jabberd.

The "Let's Encrypt" certificate authority seems to be getting more
popular, and it is quite handy, but it only issues 90-day
certificates, making the issue with reloading worse; though even with
1-year certificates, it would be better to avoid unnecessary restarts.

For a routine update (and not when a key gets compromised – then a
restart would do), I think it would be nice to begin handling new
connections with a new certificate, without disconnecting the
connected clients at once; notify the ones that didn't reconnect by
themselves after some (configurable, preferably) period of time, and
disconnect them after some more time.

P.S. Both TLS and X.509 are called "SSL" in the configuration files;
might be nice to fix that as well.

[mabels]

Here we need, also to get rid of the combined pem file containing:
cert and key.

If we got that, we can just let the jabber world point to the
/etc/letsencrypt/live/.../
world.

[smokku]

I am using letsencrypt cert in my deployments.
The script launched after refreshing the certificate first merges the files, ant then reloads jabberd. Genius!

[mabels]

For sure you can doit in that way.
But why we need this, all other software out there does not have these combined file.

So why not add this common pattern to jabberd2

cheers

meno

On 4 Nov 2016, at 13:36, Tomasz Sterna notifications@github.com wrote:

I am using letsencrypt cert in my deployments.
The script launched after refreshing the certificate first merges the files, ant then reloads jabberd. Genius!

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or mute the thread.

[smokku]

@mabels see issue #109

[defanor]

I am using letsencrypt cert in my deployments. The script launched after refreshing the certificate first merges the files, ant then reloads jabberd. Genius!

Does it mean that jabberd is able to reload certificates without a restart (simply on SIGHUP), or do you mean "restart" by "reload"? I don't quite remember how I've checked it before creating this issue report, but chances are that I've tried it, and it didn't work with jabberd version <= 2.4.0 (the one that was in centos epel repository at the time).

[smokku]

@defanor ATM the only way to reload is to restart. But the concept stays, thus this issue I assume. :)

[lifeofguenter]

would be great if we could get "zero downtime" ssl cert reloads