Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Increase cert lock time #47

Merged
merged 1 commit into from
Aug 9, 2021
Merged

Conversation

kfigiela
Copy link
Contributor

@kfigiela kfigiela commented Aug 9, 2021

There is a bug related when multiple instances of openresty are running (e.g. behind network load balancer). In such case, two instances may start certificate renewal at the same time (close enough). As indicated in #40 (comment)

Note, there is race condition between server instances as they all attempt renewals simultaneously. It causes some warning messages (and let's encrypt complaining about buggy client). You should increase lock expiration time as in this commit kfigiela/lua-resty-acme@65b3451

This PR workarounds the issue by increasing lock TTL.

@fffonion fffonion merged commit efb0602 into fffonion:master Aug 9, 2021
@fffonion
Copy link
Owner

fffonion commented Aug 9, 2021

Thanks @kfigiela !

bungle added a commit to Kong/kong that referenced this pull request Sep 29, 2021
### Summary

#### bug fixes
- ***:** use a standarlized log interface [0ff01bd](fffonion/lua-resty-acme@0ff01bd)
- **autossl:** release update_lock after cert is created to allow multiple type of certs for same domain to be created within short time [e315070](fffonion/lua-resty-acme@e315070)
- **autossl:** increase cert lock time ([#47](fffonion/lua-resty-acme#47)) [efb0602](fffonion/lua-resty-acme@efb0602)
- **tls-alpn-01:** set version 3 in certificate generated ([#49](fffonion/lua-resty-acme#49)) [887cad8](fffonion/lua-resty-acme@887cad8)
bungle added a commit to Kong/kong that referenced this pull request Sep 29, 2021
### Summary

#### bug fixes
- ***:** use a standarlized log interface [0ff01bd](fffonion/lua-resty-acme@0ff01bd)
- **autossl:** release update_lock after cert is created to allow multiple type of certs for same domain to be created within short time [e315070](fffonion/lua-resty-acme@e315070)
- **autossl:** increase cert lock time ([#47](fffonion/lua-resty-acme#47)) [efb0602](fffonion/lua-resty-acme@efb0602)
- **tls-alpn-01:** set version 3 in certificate generated ([#49](fffonion/lua-resty-acme#49)) [887cad8](fffonion/lua-resty-acme@887cad8)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants