silverwal/silver-server-ops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check the served certificate, not just the file on disk

Browse Source 
certbot renews the file but nginx serves the old certificate from memory
until reloaded, so a disk-only check reports healthy while browsers get an
expired certificate. Compare each lineage against what nginx serves over
SNI on the loopback listener.

The comparison is gated on the served certificate's SAN list covering the
domain: nginx finishes the handshake with a fallback vhost certificate
when SNI matches nothing, which would otherwise compare a lineage against
an unrelated certificate and warn falsely.
This commit is contained in:
Walusimbi Silver
2026-09-03 14:34:32 +03:00
parent c16d6dcf75
commit 4950a0e50b
2 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
README.md
View File

@@ -41,8 +41,30 @@ CERT_DIR=/etc/letsencrypt/live
EXPIRY_DAYS=25
NTFY_URL=http://127.0.0.1:2586/certbot
ALERT_ON_NO_CERTS=true
CHECK_SERVED=true
SERVED_ADDR=127.0.0.1:443
SERVED_TIMEOUT=10
```
### Served certificate check
Certbot writes a renewed certificate to disk, but nginx keeps serving the old
one from memory until it is reloaded. A check that only reads
`/etc/letsencrypt/live` reports everything as healthy while browsers are being
handed an expired certificate.
With `CHECK_SERVED=true` the script also opens a TLS connection to
`SERVED_ADDR` using each lineage's name as the SNI hostname and compares the
served expiry against the file on disk. It warns only when the served
certificate expires earlier than the one on disk, which is the signature of a
renewal hook that stopped firing.
nginx completes a handshake with a fallback vhost certificate when SNI matches
no server block, so the comparison is skipped unless the served certificate's
SAN list actually covers that domain. A lineage that nginx no longer serves is
therefore skipped rather than compared against an unrelated certificate. Set
`CHECK_SERVED=false` to disable the check.
### Overrides
```bash