service reload / HUP should reload ssl certificate [no downtime]

[phaidros7]

letsencrypt regular certificate renew leads to the neccessity to reload the ssl certificate. atm this is only possible with restart.

is there any chance to let icecast reread a new ssl certificate and use it, without disconnecting actual listeners? only new connections should use the new certificate then tho.

please consider this a question, where I do not know enough about SSL, to determine if that asked is technically feasable at all :_)

[phaidros7]

well done. kh5 actually works that way!

thanks. :)

[griffon56]

What is the command to renew the https certificate without downtime ?
On my server I need to relaunch every three months, which is the validity of Let's encrypt certificate.

[rustyhodge]

A kill -HUP (PID) should reload the certificate info without a restart, but I seem to have 6 different versions installed and only Icecast 2.4.0-kh15-20211016231513 reloads the certificate when I HUP it.

Icecast 2.4.0-kh15-20211016212453 no
Icecast 2.4.0-kh15-20211016231513 yes
Icecast 2.4.0-kh15-20211017002051 no
Icecast 2.4.0-kh15-20211017003935 no
Icecast 2.4.0-kh15-20211017010144 no
Icecast 2.4.0-kh15-20211017011012 no

Is the -20211017011012 part at the end just the build time? That then makes this even more confusing. They are running on different Ubuntu versions, but the first two are the same OS version, one reloads with the -HUP the other doesn't.

I'll experiment with installing the latest version to see what's up. Might have to do with an OpenSSL version as well?

[rustyhodge]

Nevermind.
(Correction, I was checking the installed certs not the actual SSL being served by Icecast)

Original:
Update: when I checked things just now, all the new certificates had been reloaded. I guess this is some cache / thread related behavior.

In the future I'll do a test and see just how long it takes to update the certificate on the various machines.

[rustyhodge]

I turned up error log levels now, as I'm seeing this on the machines that didn't update as expected we=hen -HUP'd:

WARN connection/get_ssl_certificate Invalid cert file /etc/icecast2/certs/somawild.crt (system lib)

So this sheds some light with 2.4.0-kh15. But the certificate is good. Stopping and restarting the Icecast process the certificate loads fine. But doing a -HUP gets that warning when the certificate is changed.

I'm replying here hoping to help some folks out (even tho this issue is closed).