letsencrypt
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
letsencrypt [2026/07/26 23:06] admin |
letsencrypt [2026/08/03 22:06] (current) admin |
||
|---|---|---|---|
| Line 17: | Line 17: | ||
| --post-hook "/etc/init.d/nginx reload"</code> | --post-hook "/etc/init.d/nginx reload"</code> | ||
| - | == /usr/local/sbin/push_to_confiared.sh == | + | == /usr/local/sbin/push_to_confiared.sh to push for IPv4 reverse proxy == |
| <code> | <code> | ||
| #!/bin/bash | #!/bin/bash | ||
| Line 37: | Line 37: | ||
| # is how a stale certificate stayed on the edges until it expired. Test the http code instead. | # is how a stale certificate stayed on the edges until it expired. Test the http code instead. | ||
| # Not -f: -f would throw away the json body, which is the only place the reason is written. | # Not -f: -f would throw away the json body, which is the only place the reason is written. | ||
| + | # | ||
| + | # The class of the code is what says whether retrying can ever help: | ||
| + | # 200 accepted, nothing more to do | ||
| + | # 4xx the api understood the request and refused it. The refusal only depends on the three | ||
| + | # files posted (expired, self signed, private key not matching the certificate...), so | ||
| + | # posting the same three again can only be refused again. Retrying anyway is what turned | ||
| + | # a single expired lineage into 100 refusals a day for three months: 06:09 to 22:39 every | ||
| + | # day, which is exactly 1 push plus 99 sleeps of 600s. | ||
| + | # other 000 when curl could not reach the api at all, or a 5xx: that one can heal by itself. | ||
| push() | push() | ||
| { | { | ||
| Line 46: | Line 55: | ||
| https://api.confiared.com/reverse-proxy/upload-certificate \ | https://api.confiared.com/reverse-proxy/upload-certificate \ | ||
| -o /var/log/last_letsencrypt_confiared_api.log) | -o /var/log/last_letsencrypt_confiared_api.log) | ||
| - | [ "$code" = "200" ] | + | case "$code" in |
| + | 200) | ||
| + | return 0 | ||
| + | ;; | ||
| + | 4??) | ||
| + | # said at the first attempt and not 16h later, and the reason is copied here because the | ||
| + | # .log above is overwritten by the next certificate this host pushes | ||
| + | echo "`date -Is` ${RENEWED_LINEAGE} refused with http ${code}, nothing to retry: $(head -c 300 /var/log/last_letsencrypt_confiared_api.log | tr '\n' ' ')" >> /var/log/last_letsencrypt_confiared_api.err | ||
| + | return 2 | ||
| + | ;; | ||
| + | *) | ||
| + | return 1 | ||
| + | ;; | ||
| + | esac | ||
| } | } | ||
| - | if push | + | push |
| - | then | + | case $? in |
| - | exit 0 | + | 0) exit 0;; |
| - | fi | + | 2) exit 1;; |
| + | esac | ||
| - | # Refused or unreachable. Retry for ~16h: the api can be down, or the refusal can be transient. | + | # The api did not answer, or answered 5xx. Only that is worth retrying, for ~16h. |
| for i in {1..99} | for i in {1..99} | ||
| do | do | ||
| sleep 600 | sleep 600 | ||
| - | if push | + | push |
| - | then | + | case $? in |
| - | exit 0 | + | 0) exit 0;; |
| - | fi | + | 2) exit 1;; |
| + | esac | ||
| done | done | ||
| - | echo "`date -Is` push refused after 99 tries, see /var/log/last_letsencrypt_confiared_api.log" >> /var/log/last_letsencrypt_confiared_api.err | + | echo "`date -Is` ${RENEWED_LINEAGE} still not pushed after 99 tries, see /var/log/last_letsencrypt_confiared_api.log" >> /var/log/last_letsencrypt_confiared_api.err |
| exit 1 | exit 1 | ||
| </code> | </code> | ||
letsencrypt.1785107178.txt.gz · Last modified: 2026/07/26 23:06 by admin
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
