4 ms·
>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new
by devwastaken 10y ago
>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from the load balancer at any give time (fingers crossed).
How many pools are there? If you're having to restart apache every time you renew a cert, are they renewing certs in the background and then only restart apache when they have around a thousand renewed? If so, wouldn't the current running certs be revoked in that time? It seems like on-the-fly cert usage is something that could be made, if not already.
- Operyl 10y agoI don't believe LE revokes certificates that get renewed, but rather lets them expire. If they implemented their stuff correctly, it should renew roughly 30 days before they expire, which in turns allows for plenty of leeway in adding in new certificates.
- predakanga 10y agoI can't speak for Apache configurations, but on-the-fly cert lookup is possible in nginx using the lua_nginx module[1] - IIRC that feature was developed by Cloudflare, to power their SSL termination. [1]: https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block https://github.com/openresty/lua-nginx-module/#ssl_certifica...
- scurvy 10y agoI was also wondering about this. I would have put in the engineering effort to migrate to nginx (at least as a front-end proxy) from Apache for this. Seems like a lot of reloads that could be avoided (even doing graceful reloads in Apache gives me the willies).