Cockpit: SSL/TLS certificate update is not complete (no problem with Nethgui)

Bug
22

I could agree, but I for sure expect many support request like “I’ve configured Let’s Encrypt but I still see the old certificate on cockpit”.
We had plenty of such requests on the NethGUI when the reload async fails.

Probably I prefer the current behavior but less support requests.
Maybe @nrauso or @filippo_carletti have different opinions.

23

Meanwhile I filed the bug report:

My solution proposal is

  1. remove the restart of cockpit-ws, to avoid the session cut off
  2. display a warning, trying to explain that to prevent disconnection the new certificate is applied to cockpit itself 90 seconds after all sessions are closed.
2 Likes
24

I confirm that this is a bug. When I change the certificate with NethGUI the problem dircribed here Nethserver-Reports (Nethesis-Dante) page fails with original NS-Cerificates is gone. When I change the cert with cockpit, the problem exists.

25

Thanks for the progress on it.

26

This is the proposal for the UI message, stating - hey don’t expect the certificate is applied immediately here

image

The same Notice is displayed on every modal dialog that changes the current certificate.

Can you see how to improve it?

1 Like
27

Is good for you have a button for forcing disconnection?

28

It is for all certificate generations? Not only Let’s Encrypt?

  • Self-signed certificate
29

Yes, it fixes cert updates and that includes self signed ones.

1 Like
30

This is a good idea, but I don’t know if it worth the effort.

For all, The fix is now in testing: could you check it out?

31

Verified!

2 Likes