HA sync overwrites certificates on backup router even if unchecked
-
I set up ACME/LE certs on our two data center routers yesterday. Twice since then I have noticed the cert is missing on the backup router, even though I disabled sync of certificates:
I'm assuming that is not expected? The backup router web server is left running with a live cert, but the web server cert dropdown is set to "IKEv2 server," the first cert it has in its list. So presumably would break upon restart. The CAs are overwritten and the router1 cert is on router2 as well so they all sync'd.
If expected, what is the solution, to use a wildcard cert? That's what we previously had, so had been syncing certs on purpose.
These routers are still on 25.07, though I don't see anything in later release notes about this.
-
If I read a bit further in the list I get to "OpenVPN configuration (Implies CA/Cert/CRL Sync)". We don't use that anymore so I suppose can uncheck that.
-
@SteveITS I use acme to obtain a certificate with three hostnames, fw-xyz.domain.com (CARP VIP), fw-a-xyz.domain.com (Primary), and fw-b-xyz.domain.com (Secondary). This runs on the primary and syncs to the secondary. Works great.
Chattanooga, Tennessee, USA
A comprehensive network diagram is worth 10,000 words and 15 conference calls.
DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM) -
@Derelict Yeah, that’d be the other option and basically what we did with the wildcard cert. Might be cleaner to let the certs sync. It just surprised me to carefully test it all on r2, set up one cert on r1, and everything disappeared on r2.
We were using the wildcard in a lot of places but are looking to avoid replacing that many cert locations every 47 days going forward… :(
-
@Derelict I realized today that although the LE cert syncs to the secondary just fine, it doesn't restart nginx which continues using the expired cert.
On the primary router the Post-Renew Actions is run to do that. That doesn't exist on the secondary because the cert doesn't exist on the secondary.
Is there a proper solution other than restarting the secondary webGUI via cron or something?
-
Bump…?
-
I do not think the secondary gets an ACME post-renew hook just because XMLRPC copied the renewed cert over. The primary ran the renewal action; the secondary mostly received config/cert material. For the webGUI case I would either use one synced cert that covers the VIP and both node names, then add a small scheduled restart of webConfigurator on the secondary after the renewal window, or test whether a normal config sync is enough to reload nginx on your version. I would avoid two independent ACME jobs unless the DNS challenge/locking is very carefully controlled.
-
@MalagaFirewall8 The challenge of a restart cron on the secondary is the timing…it’d be every 60ish days now but that interval will decrease. And if it ever doesn’t work one might want multiple jobs, etc. yet “30 days” potentially leaves a long window. So, daily? Seems excessive.
I should explain also that with HSTS a web connection to the secondary is denied.
-
I was reminded using an IP address may bypass HSTS/the invalid cert...will need to wait another couple months to try it though.
Also one could disable HSTS on the secondary router, ahead of time. (I suspect that setting is not synced...)
