Automatic SSL Certificate Renewal - Revision history

IVSWikiBlue at 15:31, 23 July 2026

2026-07-23T15:31:37Z

IVSWikiBlue at 13:08, 1 April 2026

2026-04-01T13:08:48Z

← Older revision		Revision as of 13:08, 1 April 2026
Line 12:		Line 12:
	{{Manual lvl 2 \| title = Order of Operations \| content =		{{Manual lvl 2 \| title = Order of Operations \| content =
	<ol>		<ol>
			<li>In the VALTMenu, go to <b>3 SSL Settings</b>, then select <b>4 Enable SSL Renewal Watcher</b>
	<li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>		<li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>
	<li>Copy the desired SSL server/leaf certificate into the /incoming directory</li>		<li>Copy the desired SSL server/leaf certificate into the /incoming directory</li>

IVSWikiBlue at 14:46, 23 March 2026

2026-03-23T14:46:14Z

← Older revision		Revision as of 14:46, 23 March 2026
Line 9:		Line 9:
	{{hr}}		{{hr}}

	<h1>How ~~it functions~~</h1>		<h1>How It Functions</h1>
	{{Manual lvl 2 \| title = Order of Operations \| content =		{{Manual lvl 2 \| title = Order of Operations \| content =
	<ol>		<ol>

IVSWikiBlue at 22:12, 17 March 2026

2026-03-17T22:12:00Z

← Older revision		Revision as of 22:12, 17 March 2026
Line 1:		Line 1:
	{{Article - Manual \| content =		{{Article - Manual \| content =
	<h2>Summary</h2>		<h1>Summary</h1>
	As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certificate validity periods and for ease of use.		As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certificate validity periods and for ease of use.

Line 9:		Line 9:
	{{hr}}		{{hr}}

	==How it functions==		<h1>How it functions</h1>
	===Order of Operations===		{{Manual lvl 2 \| title = Order of Operations \| content =
	<ol>		<ol>
	<li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>		<li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>
Line 27:		Line 27:
	</ul>		</ul>
	</ol>		</ol>
			}}


			{{Top of Page}}
	{{hr}}		{{hr}}

	<~~h2><center~~>Execution Frequency Options</~~center></h2~~>		<h1>Execution Frequency Options</h1>
	<table class="wikitable">		<table class="wikitable">
	<tr>		<tr>
Line 54:		Line 57:
	</table>		</table>

			{{Top of Page}}
	{{hr}}		{{hr}}

	==Error Checking==		<h1>Error Checking</h1>
	The SSL Renewal Watcher gets its own log file, located at <code>/usr/local/valt/logs/SSLRenewalWatcher.log</code>. This will include ALL log entries regarding the SSL Renewal Watcher service and the SSL Renewer. Here are just <i>some</i> of the checks it makes.		The SSL Renewal Watcher gets its own log file, located at <code>/usr/local/valt/logs/SSLRenewalWatcher.log</code>. This will include ALL log entries regarding the SSL Renewal Watcher service and the SSL Renewer. Here are just <i>some</i> of the checks it makes.


	===SSL File Checks===		{{Top of Page}}
			{{hr}}

			{{Manual lvl 2 \| title = SSL File Checks \| content =
	<ul>		<ul>
	<li>Have all 3 files (cert.pem, chain.pem, and privkey.pem) been updated within a 10-minute window?</li>		<li>Have all 3 files (cert.pem, chain.pem, and privkey.pem) been updated within a 10-minute window?</li>
Line 69:		Line 75:
	<li>Does cert.pem and privkey.pem have matching public keys?</li>		<li>Does cert.pem and privkey.pem have matching public keys?</li>
	</ul>		</ul>
			}}


			{{Top of Page}}
			{{hr - 2}}

	===Logical Process Checks===		{{Manual lvl 2 \| title = Logical Process Checks \| content =
	<ul>		<ul>
	<li>If the /usr/local/valt/ssl/incoming/ directory does not exist, do nothing</li>		<li>If the /usr/local/valt/ssl/incoming/ directory does not exist, do nothing</li>
Line 80:		Line 90:
	<li>If a file not named 'cert.pem', 'chain.pem', or 'privkey.pem' was modified in the /usr/local/valt/ssl/incoming/ directory, log that it happened but do not interact with them</li>		<li>If a file not named 'cert.pem', 'chain.pem', or 'privkey.pem' was modified in the /usr/local/valt/ssl/incoming/ directory, log that it happened but do not interact with them</li>
	</ul>		</ul>
			}}


			{{Top of Page}}
	}}		}}

IVSWikiBlue at 13:23, 17 March 2026

2026-03-17T13:23:46Z

← Older revision		Revision as of 13:23, 17 March 2026
Line 28:		Line 28:
	</ol>		</ol>

	<h3><center>Execution Frequency ~~Logic~~</center></h3>		{{hr}}

			<h2><center>Execution Frequency Options</center></h2>
	<table class="wikitable">		<table class="wikitable">
	<tr>		<tr>
	<th style="width:90px">Execution Frequency</th>		<th style="width:90px">Execution Frequency</th>
	~~<th style="width:250px">Required Variables</th>~~
	<th>What happens?</th>		<th>What happens?</th>
	</tr>		</tr>
	<tr>		<tr>
	<td><code>instant</~~code~~></td>		<td><code><b>instant</b></code></td>
	~~<td>No other variables required~~</td>		<td>Executes the renewal script <b>immediately.</b></td>
	<td>Executes the <~~code~~>~~/usr/local/valt/bin/SSLRenewer~~.~~bash~~</~~code~~> ~~script immediately.~~</td>
	</tr>		</tr>
	<tr>		<tr>
	<td><code>~~scheduled~~<~~/code~~></~~td>~~		<td><code><b>scheduled</b></code></td>
	~~<td><code~~>~~SCHEDULED_EXECUTION_DATETIME~~</code></td>		<td>Creates a one-time cronjob <b>based on the specified date and time.</b> The cronjob deletes itself after a single execution.</td>
	<td>Creates a one-time cronjob ~~based on~~ <b>~~SCHEDULED_EXECUTION_DATETIME~~</b>. The cronjob deletes itself after a single execution.</td>
	</tr>		</tr>
	<tr>		<tr>
	<td><code>~~weekly~~<~~/code~~></~~td>~~		<td><code><b>weekly</b></code></td>
	~~<td><code>WEEKY_EXECUTION_DAYOFWEEK</code~~>~~, <br><code>WEEKLY_EXECUTION_TIME~~</code></td>		<td>Creates a recurring cronjob <b>using a specified day and time of the week.</b></td>
	<td>Creates a recurring cronjob ~~using~~ <b>~~WEEKLY_EXECUTION_DAYOFWEEK</b>~~ and ~~<b>WEEKLY_EXECUTION_TIME~~</b>.</td>
	</tr>		</tr>
	<tr>		<tr>
	<td><code>~~monthly~~<~~/code~~></~~td>~~		<td><code><b>monthly</b></code></td>
	~~<td><code>MONTHLY_EXECUTION_DAY</code~~>~~, <br><code>MONTHLY_EXECUTION_TIME~~</code></td>		<td>Creates a recurring cronjob <b>using a specified date and time of the month.</b></td>
	<td>Creates a recurring cronjob ~~using~~ <b>~~MONTHLY_EXECUTION_DAY</b>~~ and ~~<b>MONTHLY_EXECUTION_TIME~~</b>.</td>
	</tr>		</tr>
	</table>		</table>

IVSWikiBlue: Created page with "{{Article - Manual | content =

Summary

As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certifi..."

2026-03-16T20:34:28Z

Created page with "{{Article - Manual | content = <h2>Summary</h2> As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certifi..."

New page

{{Article - Manual | content =
<h2>Summary</h2>
As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certificate validity periods and for ease of use.

<br>

The <b>SSL Renewal Watcher</b> is a systemd service that, when enabled, watches for changes in the <code><b>/usr/local/valt/ssl/incoming/</b></code> directory. When <code><b>cert.pem</b></code>, <code><b>chain.pem</b></code>, and <code><b>privkey.pem</b></code> are all modified within a 10-minute window, VALT will attempt to replace and install that set of incoming SSL Certificate files over the existing installed set. This operation restarts the Web, Wowza, and Nginx containers so they can utilize the updated files if there are no active recordings.

{{hr}}

==How it functions==
===Order of Operations===
<ol>
<li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>
<li>Copy the desired SSL server/leaf certificate into the /incoming directory</li>
<li>Copy the desired SSL chain certificate into the /incoming directory</li>
<li>Copy the desired SSL private key into the /incoming directory</li>
<li>The SSL Renewal Watcher will respond based on the configuration and provided SSL files:</li>
<ul>
<li>Throw an error into the <code><b>/usr/local/valt/logs/SSLRenewalWatcher.log</b></code>
<li>Execute the SSLRenewer.bash script immediately</li>
<li>Create a cronjob to execute the SSLRenewer.bash at specified datetime or interval</li>
</ul>
<li>Scenarios to consider</li>
<ul>
<li>If a SSL Renewer cronjob already exists because of a previous configuration, you can just repeat steps 1-4 and it will update the existing cronjob. No manual modifications necessary!</li>
</ul>
</ol>

<h3><center>Execution Frequency Logic</center></h3>
<table class="wikitable">
<tr>
<th style="width:90px">Execution Frequency</th>
<th style="width:250px">Required Variables</th>
<th>What happens?</th>
</tr>
<tr>
<td><code>instant</code></td>
<td>No other variables required</td>
<td>Executes the <code>/usr/local/valt/bin/SSLRenewer.bash</code> script immediately.</td>
</tr>
<tr>
<td><code>scheduled</code></td>
<td><code>SCHEDULED_EXECUTION_DATETIME</code></td>
<td>Creates a one-time cronjob based on <b>SCHEDULED_EXECUTION_DATETIME</b>. The cronjob deletes itself after a single execution.</td>
</tr>
<tr>
<td><code>weekly</code></td>
<td><code>WEEKY_EXECUTION_DAYOFWEEK</code>, <br><code>WEEKLY_EXECUTION_TIME</code></td>
<td>Creates a recurring cronjob using <b>WEEKLY_EXECUTION_DAYOFWEEK</b> and <b>WEEKLY_EXECUTION_TIME</b>.</td>
</tr>
<tr>
<td><code>monthly</code></td>
<td><code>MONTHLY_EXECUTION_DAY</code>, <br><code>MONTHLY_EXECUTION_TIME</code></td>
<td>Creates a recurring cronjob using <b>MONTHLY_EXECUTION_DAY</b> and <b>MONTHLY_EXECUTION_TIME</b>.</td>
</tr>
</table>

{{hr}}

==Error Checking==
The SSL Renewal Watcher gets its own log file, located at <code>/usr/local/valt/logs/SSLRenewalWatcher.log</code>. This will include ALL log entries regarding the SSL Renewal Watcher service and the SSL Renewer. Here are just <i>some</i> of the checks it makes.

===SSL File Checks===
<ul>
<li>Have all 3 files (cert.pem, chain.pem, and privkey.pem) been updated within a 10-minute window?</li>
<li>Is cert.pem a valid x509 certificate file?</li>
<li>Is chain.pem a valid x509 certificate file?</li>
<li>Is privkey.pem a valid RSA key file?</li>
<li>Does cert.pem and privkey.pem have matching public keys?</li>
</ul>

===Logical Process Checks===
<ul>
<li>If the /usr/local/valt/ssl/incoming/ directory does not exist, do nothing</li>
<li>If there are no files in the /usr/local/valt/ssl/incoming/ directory, do nothing</li>
<li>If any of the three files, 'cert.pem', 'chain.pem', and 'privkey.pem' do not exist in the /usr/local/valt/ssl/incoming/ directory, do nothing</li>
<li>If the certificate files in the /usr/local/valt/ssl/incoming/ directory are the exact same certificate files as the currently installed certificate files, do nothing</li>
<ul><li>If you want to override this condition, you can run '/usr/local/valt/bin/SSLRenewer.bash --force' to bypass it</li></ul>
<li>If a file not named 'cert.pem', 'chain.pem', or 'privkey.pem' was modified in the /usr/local/valt/ssl/incoming/ directory, log that it happened but do not interact with them</li>
</ul>

}}