<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Sam,<div class=""><br class=""></div><div class="">thank you for your message. What about the existing sessions (gnutls_session_t)? Can I call gnutls_credentials_clear() once the handshake is finished and keep the connection for this session established? I believe it is not safe to gnutls_certificate_free_credentials() as long as there are sessions bound to this store, is it?</div><div class=""><br class=""></div><div class="">Or is there any other best practice? Can I set other credentials on an existing session (after handshake)?</div><div class=""><br class=""></div><div class="">Thanks in advance.</div><div class=""><br class=""></div><div class="">Mario<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 2. Aug 2018, at 23:14, Sam Varshavchik <<a href="mailto:mrsam@courier-mta.com" class="">mrsam@courier-mta.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="protected-part" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="protected-title">Signed PGP part</div><div class="protected-content">Mario Lombardo writes:<br class=""><br class=""><blockquote type="cite" class="">Hi gnutls team,<br class=""><br class="">I’m looking for a way how to use gnutls for a TLS server in combination with Let’s Encrypt. As the validity of those certificates is just a couple of weeks, I would like to replace the current server key by new ones without restarting the server.<br class=""><br class="">The implementation is basically like this:<br class="">// create credstore<br class="">gnutls_certificate_allocate_credentials(&(ctx->tls_x509_cred));<br class="">// load x509 key pair<br class="">gtls_returncode = gnutls_certificate_set_x509_key_file(ctx->tls_x509_cred, ctx->config->cert_bundle, ctx->config->key_file, GNUTLS_X509_FMT_PEM);<br class="">// install signal handler<br class="">signal(SIGUSR1, signal_handler);<br class=""><br class="">Once the signal SIGUSR1 arrives, I would like to re-read x509 stuff.<br class=""><br class="">The only solution I found (yet) is to free the credstore and allocate a new one (then read new keys). This has some downsides, as the server is not working anymore if there is something wrong with the key pair, because I already freed the existing credstore (here ctx->tls_x509_cred). And even<br class=""></blockquote><br class="">Instead of gnutls_certificate_free_credentials() your old credential store first, and then gnutls_certificate_allocate_credentials() a new one and hope for the best, why don't you try gnutls_certificate_allocate_credentials() first, and if your endeavor succeeds you can free the old one, and replace it with the new one.<br class=""><br class="">You are gnutls_certificate_free_credentials() your old credential store first, right? Because if this is all what you do, that's shown above, then you must be leaking memory.<br class=""><br class=""></div></div><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><iframe class="untrusted-content-test" scrolling="auto" width="828px" height="20" data-src="data:text/html;charset=UTF-8;base64,PGlmcmFtZS1jb250ZW50Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPEJSPkdudXRscy1oZWxwIG1haWxpbmcgbGlzdDxCUj5HbnV0bHMtaGVscEBsaXN0cy5nbnV0bHMub3JnPEJSPmh0dHA6Ly9saXN0cy5nbnVwZy5vcmcvbWFpbG1hbi9saXN0aW5mby9nbnV0bHMtaGVscDwvaWZyYW1lLWNvbnRlbnQ+" sandbox="allow-scripts" name="untrusted-content-test_0" src="data:text/html;charset=UTF-8;base64,PGlmcmFtZS1jb250ZW50Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPEJSPkdudXRscy1oZWxwIG1haWxpbmcgbGlzdDxCUj5HbnV0bHMtaGVscEBsaXN0cy5nbnV0bHMub3JnPEJSPmh0dHA6Ly9saXN0cy5nbnVwZy5vcmcvbWFpbG1hbi9saXN0aW5mby9nbnV0bHMtaGVscDwvaWZyYW1lLWNvbnRlbnQ+" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; border: none; display: block; overflow: auto; height: 56px;"></iframe><br class="Apple-interchange-newline"></div></blockquote></div><br class="">
<br class=""></div></body></html>