Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by cholmon | Hacker News Reader

Full thread

cholmon·

I'm curious how renewals will be handled. According to https://github.com/icing/mod_md/wiki#no-auto-restart-when-st...

"...you have to manually restart httpd for any certificate changes to take effect."

It's easy enough to have a daily cronjob that just reloads Apache unconditionally, but that feels dirty.

View on HN

Apache supports graceful restarts, in which new children processes are spawned and old ones replaced without dropping existing connections

This doesn't affect certain portions of Apache, like the part that handles TLS.

Recent versions of Apache (2.4.x) do support it

Ah, guess I should review the documentation more frequently.

Service apache2 reload

The same thing is required of nginx.

I personally have a cron script set up on my domain gateway to update certificates once a month and reload nginx, at the end. Total unavailability is about .5 sec once a month.

Reload process in nginx isn't graceful?

It certainly is.

http://nginx.org/en/docs/beginners_guide.html#control

It is. I hadn't even looked into it, because I set the job to off hours and the domains have low enough volume even a non-graceful reload wouldn't effect anything.

Thanks for asking, because now I know. I was just assuming the same lag I see in the CLI.

Huh, that's a rather interesting limitation. I guess internally mod_md must be changing the configuration of the server with every renewal? Otherwise I'm not sure why a restart would be needed; the server should just start using the new cert for new connections.

Reply on news.ycombinator.com