Several versions ago the cert management schema changed and we got the obsolete tag.
On one node, there’s one domain created back before the ns7-8 migration and it is manual, or ‘not managed by a module’ and its type is Requested, not Obsolete.
Obviously there’s been ample time for a few successful, automatic renewals since then.
On a 2nd node, for some reason, of the 5 Different domains, the ones created back before the ns7-8 migration are marked obsolete.
Why is that?
Obsolete certificates are certificates that are not in use.
More info here: TLS certificates | NethServer 8 documentation
We probably need to clarify the official documentation. “Not in use” should be read as “the current configuration has no reference to it”.
The fact that the certificate is regularly renewed by Let’s Encrypt tells that a valid DNS record still points to the node. For example, some web client may still reach the node by that name and use a path-only HTTP route to reach an app. In this edge-case the name is effectively “in use” by some client.
For this reason and for the HTTP(S) service restart required, removal of an Obsolete certificate is something to weigh carefully.
That obsolete tag is so close to the big, shiny, “Delete obsolete” button though. I guess I’m the edge case, though I might call it, legacy case.
Two of the domain’s certs could be managed by their respective application and route if I wanted to mess with it. The other, there’s no way for the “system” to know it’s in use.
@giacomo these certs are most assuredly in use, so I’d hate for someone with less experience with NS to delete them whilst trusting the system.
Some legacy configurations may need to enable the Let’s Encrypt Certificate switch under their application Settings page.
