Re: Leaf 7.2.1 lighttpd certificate missing or invalid

Erich, I only renamed the very old lighttpd certificate as a test. I gave
it a different extension. After a save and reboot, the warning message  was
gone, and a new certificate with the leaf distribution date appeared, so I
deleted the bad certificate, saved, and rebooted. No more warning messages.

Several lessons learned here. One is to pay attention to boot messages - I
had missed the lighthtp bad certificate for the past five years!

Tim


On Wed, Apr 5, 2023, 6:36 AM Erich Titl <[email protected]> wrote:

>
>
> Am 04.04.2023 um 18:50 schrieb Timothy Wegner:
> > Erich and list,
> >
> > I apologise to everyone, I discovered that my lighttpd certificate
> problem
> > was very long standing and caused by myself. There is no problem with the
> > leaf distribution. Kp and I discussed this off-list, and I never reported
> > the resolution of this to the list. Here's a quote from my last message
> to
> > kp:
> >
> >>>
> > ... all I had to do to fix the lighttpd certificate problem was rename
> > /etc/ssl/private/lighttpd.pem to something else, save, and reboot. Then
> all
> > was well, and the correct pem file got copied to two places. This is
> > embarrassing, but the bad lighttpd.pem file had a timestamp of  April 2
> > 2018!!!!! Yikes! I've been getting that error message for five years!!
> >>>
>
> Mhhh... just changing the name of the certificate file does not make
> much sense to me. Are you using https? If so then the default path to
> the certificate file would be '/etc/ssl/private/lighttpd.pem'. The CA
> signing certificate would be
> 'etc/ssl/certs/LEAF_Bering_CA_certificate.pem'.
>
> These files are used for https only.
>
> Which place(s) is the renamed certificate file copied to so it is
> reloaded from configdb and why would such a copy change the behaviour of
> lighttpd without touching the lighttpd configuration?
>
> In my configuration lighttpd does not start at all if the certificate
> file is renamed.
>
> >
> > Let me add that my (too lazy) method of updating Leaf for many years has
> > been to copy configdb.lrp and leaf.cfg from my previous working copy. I
> am
> > long overdue for a major configdb.lrp cleanup!
>
> If you dropped mhttp for lighttpd then the old certificate files would
> still linger in /etc for at least one save operation, but this should
> not interfere with lighttpd unless you are starting both instances. Make
> sure you only load one http daemon.
>
> cheers
>
> ET
>
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/
>

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/