Mirror Server + LetsEncrypt

Discussion in 'Installation/Configuration' started by Tuumke, May 26, 2017.

  1. Tuumke

    Tuumke Member

    I am seeing that letsencrypt dirs are not synchronised. Should this happen with Unison? I checked the (bought) config manual but it's not in there?
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Letsencrypt on mirror setups is a problem and not covered yet as mirroring /etc/letsencrypt is not enough, the LE cert would break on the next LE renewal (at least on multiple active nodes) as it is not predictable that the server which requested the new LE cert will receive the callback request. The only option that I see at the moment (beside using DNS based LE verification outside of ISPConfig) is to have /etc/letsencrypt and /usr/local/ispconfig/interface/acme/ on a shared filesystem (e.g. share these folders from master to all slaves with nfs.
     
    Tuumke likes this.
  3. Tuumke

    Tuumke Member

    Okidoki, thnx Till
     
  4. sjau

    sjau Local Meanie Moderator

    Wouldn't it be sufficient on the the mirror to just rsync the /etc/letsencrypt folder regularly?

    I mean the LE certs are valid for 90 days. After 60 days the should get autorenewed.

    So with a daily cron ( rsync -avp /etc/letsencrypt/ [email protected]:/etc/letsencrypt ) it would sync the current certs once per day to the mirror. Since there's a 30-day grace period before the certs expire I think it's not harmful if the sync of the new cert is like 1 day laters.
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes and no. The problem is that the site creation on the slave might fail when the ssl cert has not been synced yet and we will have to ensure that the slave does not try to get or renew any LE certs.
     
  6. sjau

    sjau Local Meanie Moderator

    I see. I don't use mirror setup so I know too little about it.
     
  7. Tuumke

    Tuumke Member

    I think im gonna switch back to a single server and just have a 2nd web/mysql host.
     

Share This Page