When a certificate generation fails, the verify task fails but the task still writes the certificate path to the virtualhost file.

This breaks apache, as the virtualhost config is broken, so apache can't reload or start.

We should:

  1. Only throw a warning if certificate generation fails. The site will still work in this situation, so a warning is more appropriate.
  2. Don't write the certificate file info to virtualhost configs if there isn't one. See #3020747: Don't add SSL config to configuration files if the crt files aren't there/aren't readable. (especially redirects)
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Jon Pugh created an issue. See original summary.

  • Jon Pugh committed c99f857 on 3014468-graceful-fail
    Issue #3014468: Gracefully handle LetsEncrypt certificate generation...
Jon Pugh’s picture

Status: Active » Needs review
Issue tags: +NEDCamp2018
FileSize
1.72 KB

  • Jon Pugh committed 4e8dd3c on 3014468-graceful-fail
    Issue #3014468: Gracefully handle LetsEncrypt certificate generation...
Jon Pugh’s picture

FileSize
2.54 KB
colan’s picture

Status: Needs review » Needs work

Typo?

hosting_https_fail_task_if_certificate_failes

Should be "fails"?

helmo’s picture

Jon Pugh’s picture

Assigned: Unassigned » Jon Pugh
Issue summary: View changes

  • Jon Pugh committed 68291e5 on 3014468-graceful-fail
    Revert part of issue #3014468.
    

  • Jon Pugh committed 84afff9 on 3014468-graceful-fail
    Revert "Issue #3014468: Gracefully handle LetsEncrypt certificate...
Jon Pugh’s picture

Title: Gracefully handle LetsEncrypt certificate generation failures by settiing warnings and not modifying vhost config. » Gracefully handle LetsEncrypt certificate generation failures by throwing warnings instead of failing
Status: Needs work » Needs review
FileSize
987 bytes
Jon Pugh’s picture

Not quite a duplicate, but did have overlapping results. I removed the changes related to turning off HTTPS/SSL, since that is now handled in #3020747: Don't add SSL config to configuration files if the crt files aren't there/aren't readable. (especially redirects)

The warning option for LE certs is still a good idea, I think.

Jon Pugh’s picture

Typos fixed. Ready for review.

  • Jon Pugh committed 4e8dd3c on 7.x-3.x
    Issue #3014468: Gracefully handle LetsEncrypt certificate generation...
  • Jon Pugh committed 68291e5 on 7.x-3.x
    Revert part of issue #3014468.
    
  • Jon Pugh committed 84afff9 on 7.x-3.x
    Revert "Issue #3014468: Gracefully handle LetsEncrypt certificate...
  • Jon Pugh committed c99f857 on 7.x-3.x
    Issue #3014468: Gracefully handle LetsEncrypt certificate generation...

  • Jon Pugh committed f38bd32 on 7.x-3.x
    Issue #3014468: Respect option for throwing error or warning.
    
Jon Pugh’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.