fedora-infrastructure

#13051 Non-idempotent proxy certificate plays
Closed: Migrated to Fedora Forge by ryanlerch. Opened by gwmngilfen.

Closed: Migrated to Fedora Forge
Reopen Issue

I was fixing #13048 (getfedora.org has expired SSL certificate) today, and noticed an odd thing.... The proxy playbook seems to be non-idempotent - it copies certs from the private repo AND from certgetter:

TASK [httpd/certificate : Copy getfedora.org.cert]
ok: [proxy01.rdu3.fedoraproject.org] => (item= {{private }}/files/httpd/getfedora.org.cert)
TASK [letsencrypt : Obtain the certificate] 
ok: [proxy01.rdu3.fedoraproject.org -> certgetter01.rdu3.fedoraproject.org]
TASK [letsencrypt : Install the certificate] 
changed: [proxy01.rdu3.fedoraproject.org]

So I guess the root cause of #13048 is that the first part ran but not the second, and deployed an old cert, right?

So, I think I have two questions:
- Should we fix that? Why are we deploying certs twice?
- Should we monitor that? I'm thinking a Zabbix LLD on certgetter01 could discover all the certs in certbot, and add items for certificate age and https checks to the site.... Is there a reason not to do that (other than old sites that need to be deleted anyway)?

Thoughts @zlopez @james @kevin?

This is probibly my fault. ;(

This cert used to be a digicert one (which we needed because letsencrypt wouldn't provide certs that would work with FUTURE crypto and that was our 'main' download site).
But we since moved all our stuff to fedoraproject.org proper, so getfedora is just a redirect now... so I moved it to just use letsencrypt.

I must have failed to clean up properly. ;(

Can you do so, or shall I?

I can probably sort it. I'll do a PR so you can check :thumbsup:

Metadata Update from @kevin:
- Issue assigned to gwmngilfen
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: low-gain, low-trouble, ops

Did you get a chance to do a PR here, or would you like me to?

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/13051

Please continue any further discussion there.

Metadata Update from @ryanlerch:
- Issue close_status updated to: Migrated to Fedora Forge
- Issue status updated to: Closed (was: Open)
Metadata

low-gain low-trouble ops

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.