Difference between revisions of "Automatic SSL Certificate Renewal"

From IVS Wiki
Jump to: navigation, search
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
 
{{Article - Manual | content =  
 
{{Article - Manual | content =  
 
<h1>Summary</h1>
 
<h1>Summary</h1>
−
As of version 6.5, VALT has the capability of automatically applying renewed certificates to help combat the shortened certificate validity periods and for ease of use.
+
As of version 6.5, VALT can automatically apply renewed SSL certificates for you.
  
 
<br>
 
<br>
  
−
The <b>SSL Renewal Watcher</b> is a systemd service that, when enabled, watches for changes in the <code><b>/usr/local/valt/ssl/incoming/</b></code> directory. When <code><b>cert.pem</b></code>, <code><b>chain.pem</b></code>, and <code><b>privkey.pem</b></code> are all modified within a 10-minute window, VALT will attempt to replace and install that set of incoming SSL Certificate files over the existing installed set. This operation restarts the Web, Wowza, and Nginx containers so they can utilize the updated files if there are no active recordings.
+
When enabled from the VALTMenu, the <b>SSL Renewal Watcher</b> watches the <code><b>/usr/local/valt/ssl/incoming/</b></code> directory. When a complete certificate set appears within a 10-minute window, VALT installs it over the existing set and restarts the Web, Wowza, and Nginx containers so they use the new files (deferred, and noted in the log, if there are active recordings). A complete set is either:
 +
<ul>
 +
<li><code><b>fullchain.pem</b></code> + <code><b>privkey.pem</b></code> &nbsp;<i>(also use this form for a leaf-only certificate)</i></li>
 +
<li><code><b>cert.pem</b></code> + <code><b>chain.pem</b></code> + <code><b>privkey.pem</b></code></li>
 +
</ul>
  
 
{{hr}}
 
{{hr}}
Line 12: Line 16:
 
{{Manual lvl 2 | title = Order of Operations | content =  
 
{{Manual lvl 2 | title = Order of Operations | content =  
 
<ol>
 
<ol>
−
  <li>Modify the config file <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> to the desired settings</li>
+
  <li>In the VALTMenu, go to <b>3 SSL Settings</b>, then select <b>4 Enable SSL Renewal Watcher</b>.</li>
−
<li>Copy the desired SSL server/leaf certificate into the /incoming directory</li>
+
  <li>Set the schedule in <code><b>/usr/local/valt/conf/ssl_renewer_config</b></code> (see <b>Execution Frequency Options</b> below).</li>
−
<li>Copy the desired SSL chain certificate into the /incoming directory</li>
+
  <li>Copy a complete certificate set (either format above) into the /incoming directory.</li>
−
  <li>Copy the desired SSL private key into the /incoming directory</li>
 
−
<li>The SSL Renewal Watcher will respond based on the configuration and provided SSL files:</li>
 
−
<ul>
 
−
  <li>Throw an error into the <code><b>/usr/local/valt/logs/SSLRenewalWatcher.log</b></code>
 
−
  <li>Execute the SSLRenewer.bash script immediately</li>
 
−
  <li>Create a  cronjob to execute the SSLRenewer.bash at specified datetime or interval</li>
 
−
  </ul>
 
−
  <li>Scenarios to consider</li>
 
−
  <ul>
 
−
  <li>If a SSL Renewer cronjob already exists because of a previous configuration, you can just repeat steps 1-4 and it will update the existing cronjob. No manual modifications necessary!</li>
 
−
  </ul>
 
 
</ol>
 
</ol>
 +
 +
Based on the frequency: <b>instant</b> applies the set immediately, while <b>scheduled</b>, <b>weekly</b>, and <b>monthly</b> apply it at the configured time — copy in a fresh set before each scheduled run. Editing the config later automatically updates the schedule. All activity is logged to <code><b>/usr/local/valt/logs/SSLRenewalWatcher.log</b></code>.
 
}}
 
}}
  
−
 
−
{{Top of Page}}
 
 
{{hr}}
 
{{hr}}
  
Line 41: Line 34:
 
   <tr>
 
   <tr>
 
     <td><code><b>instant</b></code></td>
 
     <td><code><b>instant</b></code></td>
−
     <td>Executes the renewal script <b>immediately.</b></td>
+
     <td>Applies the certificates <b>immediately.</b></td>
 
   </tr>
 
   </tr>
 
   <tr>
 
   <tr>
 
     <td><code><b>scheduled</b></code></td>
 
     <td><code><b>scheduled</b></code></td>
−
     <td>Creates a one-time cronjob <b>based on the specified date and time.</b> The cronjob deletes itself after a single execution.</td>
+
     <td>Runs <b>once</b> at the specified date and time, then removes itself.</td>
 
   </tr>
 
   </tr>
 
   <tr>
 
   <tr>
 
     <td><code><b>weekly</b></code></td>
 
     <td><code><b>weekly</b></code></td>
−
     <td>Creates a recurring cronjob <b>using a specified day and time of the week.</b></td>
+
     <td>Runs <b>every week</b> on the specified day and time.</td>
 
   </tr>
 
   </tr>
 
   <tr>
 
   <tr>
 
     <td><code><b>monthly</b></code></td>
 
     <td><code><b>monthly</b></code></td>
−
     <td>Creates a recurring cronjob <b>using a specified date and time of the month.</b></td>
+
     <td>Runs <b>every month</b> on the specified day and time.</td>
 
   </tr>
 
   </tr>
 
</table>
 
</table>
  
−
{{Top of Page}}
 
 
{{hr}}
 
{{hr}}
  
 
<h1>Error Checking</h1>
 
<h1>Error Checking</h1>
−
The SSL Renewal Watcher gets its own log file, located at <code>/usr/local/valt/logs/SSLRenewalWatcher.log</code>. This will include ALL log entries regarding the SSL Renewal Watcher service and the SSL Renewer. Here are just <i>some</i> of the checks it makes.
+
All activity is logged to <code>/usr/local/valt/logs/SSLRenewalWatcher.log</code>. Before installing, the watcher confirms:
−
 
 
−
 
 
−
{{Top of Page}}
 
−
{{hr}}
 
−
 
 
−
{{Manual lvl 2 | title = SSL File Checks | content =
 
−
<ul>
 
−
<li>Have all 3 files (cert.pem, chain.pem, and privkey.pem) been updated within a 10-minute window?</li>
 
−
<li>Is cert.pem a valid x509 certificate file?</li>
 
−
<li>Is chain.pem a valid x509 certificate file?</li>
 
−
<li>Is privkey.pem a valid RSA key file?</li>
 
−
<li>Does cert.pem and privkey.pem have matching public keys?</li>
 
−
</ul>
 
−
}}
 
−
 
 
−
 
 
−
{{Top of Page}}
 
−
{{hr - 2}}
 
−
 
 
−
{{Manual lvl 2 | title = Logical Process Checks | content =
 
 
<ul>
 
<ul>
−
  <li>If the /usr/local/valt/ssl/incoming/ directory does not exist, do nothing</li>
+
  <li>A complete set was updated within the 10-minute window.</li>
−
  <li>If there are no files in the /usr/local/valt/ssl/incoming/ directory, do nothing</li>
+
  <li>Each certificate is a valid x509 certificate and the private key is valid (RSA or EC).</li>
−
  <li>If any of the three files, 'cert.pem', 'chain.pem', and 'privkey.pem' do not exist in the /usr/local/valt/ssl/incoming/ directory, do nothing</li>
+
  <li>The leaf certificate and private key match, the certificate is not expired, and the chain is valid.</li>
−
  <li>If the certificate files in the /usr/local/valt/ssl/incoming/ directory are the exact same certificate files as the currently installed certificate files, do nothing</li>
+
  <li>The incoming certificates differ from the ones already installed (otherwise it skips; override with <code>SSLRenewer.bash --force</code>).</li>
−
<ul><li>If you want to override this condition, you can run '/usr/local/valt/bin/SSLRenewer.bash --force' to bypass it</li></ul>
 
−
<li>If a file not named 'cert.pem', 'chain.pem', or 'privkey.pem' was modified in the /usr/local/valt/ssl/incoming/ directory, log that it happened but do not interact with them</li>
 
 
</ul>
 
</ul>
−
}}
+
Any files that are not part of a valid set are logged and ignored.
−
 
 
  
 
{{Top of Page}}
 
{{Top of Page}}
 
}}
 
}}

Latest revision as of 10:31, 23 July 2026

Summary

As of version 6.5, VALT can automatically apply renewed SSL certificates for you.


When enabled from the VALTMenu, the SSL Renewal Watcher watches the /usr/local/valt/ssl/incoming/ directory. When a complete certificate set appears within a 10-minute window, VALT installs it over the existing set and restarts the Web, Wowza, and Nginx containers so they use the new files (deferred, and noted in the log, if there are active recordings). A complete set is either:

  • fullchain.pem + privkey.pem  (also use this form for a leaf-only certificate)
  • cert.pem + chain.pem + privkey.pem

How It Functions

Order of Operations

  1. In the VALTMenu, go to 3 SSL Settings, then select 4 Enable SSL Renewal Watcher.
  2. Set the schedule in /usr/local/valt/conf/ssl_renewer_config (see Execution Frequency Options below).
  3. Copy a complete certificate set (either format above) into the /incoming directory.

Based on the frequency: instant applies the set immediately, while scheduled, weekly, and monthly apply it at the configured time — copy in a fresh set before each scheduled run. Editing the config later automatically updates the schedule. All activity is logged to /usr/local/valt/logs/SSLRenewalWatcher.log.

Execution Frequency Options

Execution Frequency What happens?
instant Applies the certificates immediately.
scheduled Runs once at the specified date and time, then removes itself.
weekly Runs every week on the specified day and time.
monthly Runs every month on the specified day and time.

Error Checking

All activity is logged to /usr/local/valt/logs/SSLRenewalWatcher.log. Before installing, the watcher confirms:

  • A complete set was updated within the 10-minute window.
  • Each certificate is a valid x509 certificate and the private key is valid (RSA or EC).
  • The leaf certificate and private key match, the certificate is not expired, and the chain is valid.
  • The incoming certificates differ from the ones already installed (otherwise it skips; override with SSLRenewer.bash --force).

Any files that are not part of a valid set are logged and ignored.

⇧ Back to Top
Retrieved from "https://ivs.help/wiki/index.php?title=Automatic_SSL_Certificate_Renewal&oldid=17774"