Update SSL certificates through file upload
Published 8 days ago
Published 8 days ago
Peter Larin
Updated 8 days ago
0
I'm referring to this doc:
https://docs.waf.chaitin.com/reference/articles/ssl-update
I followed the instruction:
- uploaded certs via GUI, made sure they are served by tengine. They did appear in the bind-mounted folder
/data/safeline/resources/nginx/certs - overwrote them with updated certs
- waited 1.5 hours but nothing happened. WAF Automatic Update - didn't happen. So what does it exactly mean: "WAF refreshes certificate content every hour by default."???
I had to reload tengine manually for the new cert to start to be served.
Carrie
Updated 8 days ago
The statement in the documentation, "WAF refreshes certificate content every hour by default," refers to uploading a new certificate and rebinding a domain from the old certificate to the new one. This automatically updates the certificate binding. It does not mean that Tengine is automatically reloaded when certificate files on disk are updated.
We'll update the doc to on this later and also include after replacing an SSL certificate, you need to reload Tengine manually for the new certificate to take effect.
As for automatically reloading Tengine after a certificate update, our product team will further evaluate whether this should be supported in a future release.
Thanks for your valuable feedback!!
Peter Larin
Updated 7 days ago
0
Alright, thank you! Via API, can I update an existing cert in one request?Or should i delete it first, then upload the new one?
Carrie
Updated 7 days ago
Yes. You can call POST /open/certto update an existing certificate directly, no need to delete the old certificate first.
Peter Larin
Updated 6 days ago
0
Actually I must correct myself. Yesterday we did some extended testing and found out that
- we place a new cert pair to /data/safeline/resources/nginx/certs
- every hour Safeline compares the certs in this dir against the DB
- if it finds difference, it uploads the new cert to DB and restarts tengine
- if no difference - no action
tested and confirmed on 9.3.7 !
Carrie
Updated 5 days ago
I might not explain this clearly before:
If you're updating an existing SSL certificate by replacing the old certificate files with new ones, this will not automatically reload Tengine.
However, if you upload a new certificate and then rebind the domain from the old certificate to the new one, SafeLine will check the certificate binding every hour. If it detects a change, it will automatically synchronize the update and reload Tengine.