[gnutls-help] TLS-Server with Let’s Encrypt
mrsam at courier-mta.com
Thu Aug 2 23:14:46 CEST 2018
Mario Lombardo writes:
> Hi gnutls team,
> I’m looking for a way how to use gnutls for a TLS server in combination with
> Let’s Encrypt. As the validity of those certificates is just a couple of
> weeks, I would like to replace the current server key by new ones without
> restarting the server.
> The implementation is basically like this:
> // create credstore
> // load x509 key pair
> gtls_returncode = gnutls_certificate_set_x509_key_file(ctx->tls_x509_cred,
> ctx->config->cert_bundle, ctx->config->key_file, GNUTLS_X509_FMT_PEM);
> // install signal handler
> signal(SIGUSR1, signal_handler);
> Once the signal SIGUSR1 arrives, I would like to re-read x509 stuff.
> The only solution I found (yet) is to free the credstore and allocate a new
> one (then read new keys). This has some downsides, as the server is not
> working anymore if there is something wrong with the key pair, because I
> already freed the existing credstore (here ctx->tls_x509_cred). And even
Instead of gnutls_certificate_free_credentials() your old credential store
first, and then gnutls_certificate_allocate_credentials() a new one and hope
for the best, why don't you try gnutls_certificate_allocate_credentials()
first, and if your endeavor succeeds you can free the old one, and replace
it with the new one.
You are gnutls_certificate_free_credentials() your old credential store
first, right? Because if this is all what you do, that's shown above, then
you must be leaking memory.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 801 bytes
Desc: not available
More information about the Gnutls-help