trafficcontrol icon indicating copy to clipboard operation
trafficcontrol copied to clipboard

Published 20 hours ago • verified publisher icon apache

API acme_autorenew: Renewal are not being kicked off

Open smalenfant opened this issue 2 years ago • 8 comments

After upgrading to 6.1.0 from 5.1.2. Also enabling Postgresql Traffic Vault. Certificate renewal trigger via the API isn't working anymore.

Note that using "renew" fro Traffic Portal for a single Delivery Service works (Sometimes fails, different issue).

This Bug Report affects these Traffic Control components:

  • Traffic Ops (6.1.0)

Current behavior:

After issuing this API: /usr/local/bin/topost -a 4.0 /acme_autorenew

Logs are filled with the following for each certificate needed renewal:

getting ssl keys for xmlId: cdvr-4k and version: 1 : could not begin Traffic Vault PostgreSQL transaction: context canceled: context canceled

Expected behavior:

Certificates to be renewed.

Steps to reproduce:

See current behavior.

smalenfant avatar Oct 12 '22 15:10 smalenfant

I have changed the backend to Riak and autorenew is now working.

smalenfant avatar Oct 12 '22 16:10 smalenfant

@smalenfant - can you add to the description which version(s) of TC this bug exists in.

mitchell852 avatar Oct 17 '22 15:10 mitchell852

@mitchell852 It's in there already. Maybe not clear. After upgrading to 6.1.0 from 5.1.2

smalenfant avatar Oct 19 '22 17:10 smalenfant

@mitchell852 It's in there already. Maybe not clear. After upgrading to 6.1.0 from 5.1.2

cool. guess i didn't see that. :)

mitchell852 avatar Oct 19 '22 17:10 mitchell852

I also noticed that the expiration is not set when doing the riak->postgreql migration. Not sure if this could affect the functionality of the renewal.

smalenfant avatar Oct 19 '22 17:10 smalenfant

not being able to renew a cert seems like high impact (as opposed to low), right? @ocket8888

mitchell852 avatar Mar 14 '23 17:03 mitchell852

I don't think so. That would only impact a single delivery service at a time, only if they use this method of obtaining a cert, and only if they decide to use auto-renewal. There are a lot of ways around this and a lot of ways the problem is contained.

ocket8888 avatar Mar 15 '23 18:03 ocket8888

I don't think so. That would only impact a single delivery service at a time, only if they use this method of obtaining a cert, and only if they decide to use auto-renewal. There are a lot of ways around this and a lot of ways the problem is contained.

medium a good compromise? :)

mitchell852 avatar Mar 15 '23 20:03 mitchell852