#5378 WEBMIN does not update SSL certificates automatically while run

[dredkin]

As we know every third SSL certificate is issued by Letsencrypt, and they last only 3 month maximum.
BUT wedmin only reads SSL certificate once upon start, so webmin to work I MUST restart it after every certificate update.
That is very inconvenient.
Webmin itself CAN see the date of current certificate, and it CAN reload a certificate when it's running (just press the button 'SAVE' in current certificate tab). Why cannot it AUTOMATICALLY try to re-read it when it's expired? That should be so easy to implement...

[Jamie Cameron]

This is expected - however, if you use Webmin or Virtualmin to renew the cert, it will be automatically applied to Webmin.

[dredkin]

It is not expected by an average user, it is inconvenient and easy to fix.
Also I'm not sure webmin can handle my letsencrypt case (several *.
Domains in one certificate).

сб, 6 июн. 2020 г., 6:49 Jamie Cameron jcameron@users.sourceforge.net:

This is expected - however, if you use Webmin or Virtualmin to renew the
cert, it will be automatically applied to Webmin.

---

• [bugs:#5378] https://sourceforge.net/p/webadmin/bugs/5378/ WEBMIN does
  not update SSL certificates automatically while run*

Status: open
Group: 1.940
Labels: SSL LETSENCRYPT
Created: Fri Jun 05, 2020 12:21 PM UTC by dredkin
Last Updated: Fri Jun 05, 2020 12:21 PM UTC
Owner: nobody

As we know every third SSL certificate is issued by Letsencrypt, and they
last only 3 month maximum.
BUT wedmin only reads SSL certificate once upon start, so webmin to work I
MUST restart it after every certificate update.
That is very inconvenient.
Webmin itself CAN see the date of current certificate, and it CAN reload a
certificate when it's running (just press the button 'SAVE' in current
certificate tab). Why cannot it AUTOMATICALLY try to re-read it when it's
expired? That should be so easy to implement...

---

Sent from sourceforge.net because you indicated interest in
https://sourceforge.net/p/webadmin/bugs/5378/

To unsubscribe from further messages, please visit
https://sourceforge.net/auth/subscriptions/

[Jamie Cameron]

While technically it would be possible to have webmin automatically re-read the SSL cert, that would go against the way other servers like Apache work - they all only load updated certs when restarted.

[dredkin]

Hmm.... Loks like you're right, but somehow (I don't know why) I never had to reload apache after renewing certificate, but have to restart webmin...

[Jamie Cameron]

In my experience, Apache has always needed a restart to pick up new certs ... unless that has changed in recent releases?

[dredkin]

I've googled a bit and it looks like some letsencrypt apache plugin can request to reload apache configuration (apache rereads certificates not only on restart, but also on reload). Looks like that's why I never experianced this. But I'm not sure...

[Ian]

If you let letsencrypt set up a cron job to renew the certificates (the default) then just have a shell script in

/etc/letsencrypt/renewal-hooks/deploy/

to restart what ever needs restarting. Using webroot authentication doesn't do that for Apache, so I reload that and restart ssh, webmin and the mail server every time the certificate is successfully renewed.

[Ilia]

Also I'm not sure webmin can handle my letsencrypt case (several *. Domains in one certificate).

Yes, it can. You need to use DNS validation and have certbot package installed.