{"action":"created","issue":{"url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/70","repository_url":"https://api.github.com/repos/SWI-Prolog/packages-http","labels_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/70/comments","events_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/70/events","html_url":"https://github.com/SWI-Prolog/packages-http/issues/70","id":195330016,"number":70,"title":"SSL Certificate renewal","user":{"login":"JanWielemaker","id":3071146,"avatar_url":"https://avatars.githubusercontent.com/u/3071146?v=3","gravatar_id":"","url":"https://api.github.com/users/JanWielemaker","html_url":"https://github.com/JanWielemaker","followers_url":"https://api.github.com/users/JanWielemaker/followers","following_url":"https://api.github.com/users/JanWielemaker/following{/other_user}","gists_url":"https://api.github.com/users/JanWielemaker/gists{/gist_id}","starred_url":"https://api.github.com/users/JanWielemaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JanWielemaker/subscriptions","organizations_url":"https://api.github.com/users/JanWielemaker/orgs","repos_url":"https://api.github.com/users/JanWielemaker/repos","events_url":"https://api.github.com/users/JanWielemaker/events{/privacy}","received_events_url":"https://api.github.com/users/JanWielemaker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-12-13T18:23:02Z","updated_at":"2016-12-15T00:27:45Z","closed_at":null,"body":"Just setup a server using LetsEncrypt!  Thanks to https://github.com/triska/letswicrypt that wasn't too hard.   LetsEncrypt! certificates expire quickly though.  Setting up automatic renewal of the certificates themselves isn't too hard, but how to update a (long) running server?\r\n\r\nIdeally it would check the modification times of the certifications, but it can't because the  LetsEncrypt! certificates are only readable by root and the server long lost the privileges to read them.   I see two ways out:\r\n\r\n  - Encrypt the private key and only read the password as root.  If the key itself and the certificate \r\n    chain are world readable (which is fine AFAIK as long as the private key is encrypted), it should\r\n    be possible to update the SSL context used by the server without restart.\r\n  - On startup read the expiration date from the certificate and commit suicide at some scheduled\r\n    time the day before."},"comment":{"url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/comments/267200001","html_url":"https://github.com/SWI-Prolog/packages-http/issues/70#issuecomment-267200001","issue_url":"https://api.github.com/repos/SWI-Prolog/packages-http/issues/70","id":267200001,"user":{"login":"triska","id":7482140,"avatar_url":"https://avatars.githubusercontent.com/u/7482140?v=3","gravatar_id":"","url":"https://api.github.com/users/triska","html_url":"https://github.com/triska","followers_url":"https://api.github.com/users/triska/followers","following_url":"https://api.github.com/users/triska/following{/other_user}","gists_url":"https://api.github.com/users/triska/gists{/gist_id}","starred_url":"https://api.github.com/users/triska/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/triska/subscriptions","organizations_url":"https://api.github.com/users/triska/orgs","repos_url":"https://api.github.com/users/triska/repos","events_url":"https://api.github.com/users/triska/events{/privacy}","received_events_url":"https://api.github.com/users/triska/received_events","type":"User","site_admin":false},"created_at":"2016-12-15T00:27:45Z","updated_at":"2016-12-15T00:27:45Z","body":"Note also that you can already now use `sni_hook/1` to provide the most recent certificate and key on the fly for each request.\r\n\r\nYou can make this quite efficient as well, only reloading from the file if anything has changed.\r\n\r\nThis of course requires SNI also on the client-side, and leads to zero downtime already now."}}
{"actor":{"display_login":"triska"}}