WikiSuite/openfire

Hotdeploy of renewed LetsEncrypt certificates isn't handled

benoitg opened this issue · 5 comments

benoitg commented

The hotdeploy code for LetsEncrypt certificate has been disabled in app-openfire: https://github.com/WikiSuite/app-openfire/blob/4f035df45d872a8127fcaf5c493894dddd370758/libraries/Openfire.php#L374, which makes sense since it would only run if an admin edits the form.

However, we need the rpm to setup a system so the certificated are copied to the hotdeploy directory when Let's Encrypt renews them, using hooks in /etc/letsencrypt/renewal-hooks/

benoitg commented

I just realized I don't even need any kind of flow control or access mangling. If one executes the same code as when the ssl certificate form is saved, the new certificate will be imported in the keystore, which bypasses file permission issue (and associated additional security issue)

pcbaldwin commented

Getting there! The Certificate Manager was refactored, but there are about a dozen tracker items that need to be reviewed.

benoitg commented

@pcbaldwin Anything I can help with?

pcbaldwin commented

I'm still working on the tracker items. Thanks for asking.