Skip to content

When option ALWAYS_GENERATE_KEY set to true all certs are regenerated #12

Closed
Closed
When option ALWAYS_GENERATE_KEY set to true all certs are regenerated#12

Description

@papalaxium
papalaxium
opened on Mar 19, 2025

Hello,

We have several certificates configured on our F5.

When option ALWAYS_GENERATE_KEY is set to false, certificates are only generated when they don't exist or when they are about to expire when executing f5acmehandler.sh

When option ALWAYS_GENERATE_KEY is set to false, certificates are always generated (even way before expiration).

This occurs even when --save option is positioned after a config file modification.

[name@F5:Active:In` Sync] acme # ./f5acmehandler.sh --save --verbose
>> [2025-03-19_11:57:29]  DEBUG Pulling acme account state information from iFile central storage

>> [2025-03-19_11:57:29]  DEBUG SAVECONFIG enabled - working from local config data

>> [2025-03-19_11:57:29]  DEBUG (handler function: process_handler_config)
   --domain argument specified for (preprod.site1.fr).

>> [2025-03-19_11:57:29]  DEBUG (handler function: process_handler_config)
   VAR: DOMAIN=preprod.site1.fr
   VAR: COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com"

>> [2025-03-19_11:57:29]  DEBUG: Certificate does not exist, or ALWAYS_GENERATE_KEY is true --> call generate_new_cert_key.

>> [2025-03-19_11:57:29]  DEBUG (handler function: generate_new_cert_key)
   DOMAIN=preprod.site1.fr
   COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com"

>> [2025-03-19_11:57:29]  DEBUG (handler: ACME client command):
/shared/acme/dehydrated -x -k /shared/acme/f5hook.sh -t http-01 -c -g -d preprod.site1.fr --ca https://acme.com/directory --config /shared/acme/config_acme.com

>> [2025-03-19_11:58:13]  DEBUG (handler: ACME client output):
    # INFO: Using main config file /shared/acme/config_acme.com

    >> DEBUG (hook function: startup_hook)

    Processing preprod.site1.fr
     + Creating new directory /shared/acme/certs/preprod.site1.fr ...
     + Signing domains...
     + Generating private key...
     + Generating signing request...
     + Requesting new certificate order from CA...
     + Received 1 authorizations URLs from the CA
     + Handling authorization for preprod.site1.fr
     + 1 pending challenge(s)
     + Deploying challenge tokens...

    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=preprod.site1.fr
       TOKEN_FILENAME=97d134de-147c-4ce2-a73a-85400f9e5a23
       TOKEN_VALUE=97d134de-147c-4ce2-a73a-85400f9e5a23.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Responding to challenge for preprod.site1.fr authorization...
     + Challenge is valid!
     + Cleaning challenge tokens...

    >> DEBUG (hook function: clean_challenge)
       DOMAIN=preprod.site1.fr
       TOKEN_FILENAME=97d134de-147c-4ce2-a73a-85400f9e5a23
       TOKEN_VALUE=97d134de-147c-4ce2-a73a-85400f9e5a23.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Requesting certificate...
     + Checking certificate...
     + Done!
     + Creating fullchain.pem...

    >> DEBUG (hook function: sync_cert)
       KEYFILE=/shared/acme/certs/preprod.site1.fr/privkey-1742381852.pem
       CERTFILE=/shared/acme/certs/preprod.site1.fr/cert-1742381852.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site1.fr/fullchain-1742381852.pem
       CHAINFILE=/shared/acme/certs/preprod.site1.fr/chain-1742381852.pem
       REQUESTFILE=/shared/acme/certs/preprod.site1.fr/cert-1742381852.csr


    >> DEBUG (hook function: deploy_cert)
       DOMAIN=preprod.site1.fr
       KEYFILE=/shared/acme/certs/preprod.site1.fr/privkey.pem
       CERTFILE=/shared/acme/certs/preprod.site1.fr/cert.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site1.fr/fullchain.pem
       CHAINFILE=/shared/acme/certs/preprod.site1.fr/chain.pem
       TIMESTAMP=1742381852


    >> DEBUG (hook function: deploy_cert -> Updating existing cert and key)

    Command added to the current transaction
    Command added to the current transaction
     + Done!

    >> DEBUG (hook function: exit_hook)
       ERROR=


>> [2025-03-19_11:58:13]  DEBUG (handler function: process_handler_config)
   --domain argument specified for (preprod.site2.fr).

>> [2025-03-19_11:58:13]  DEBUG (handler function: process_handler_config)
   VAR: DOMAIN=preprod.site2.fr
   VAR: COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com -d preprod1.site2.fr -d preprod2.site2.fr -d www.preprod.site2.fr"

>> [2025-03-19_11:58:14]  DEBUG: Certificate does not exist, or ALWAYS_GENERATE_KEY is true --> call generate_new_cert_key.

>> [2025-03-19_11:58:14]  DEBUG (handler function: generate_new_cert_key)
   DOMAIN=preprod.site2.fr
   COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com -d preprod1.site2.fr -d preprod2.site2.fr -d www.preprod.site2.fr"

>> [2025-03-19_11:58:14]  DEBUG (handler: ACME client command):
/shared/acme/dehydrated -x -k /shared/acme/f5hook.sh -t http-01 -c -g -d preprod.site2.fr --ca https://acme.com/directory --config /shared/acme/config_acme.com -d preprod1.site2.fr -d preprod2.site2.fr -d www.preprod.site2.fr

>> [2025-03-19_11:59:36]  DEBUG (handler: ACME client output):
    # INFO: Using main config file /shared/acme/config_acme.com

    >> DEBUG (hook function: startup_hook)

    Processing preprod.site2.fr with alternative names: preprod1.site2.fr preprod2.site2.fr www.preprod.site2.fr
     + Creating new directory /shared/acme/certs/preprod.site2.fr ...
     + Signing domains...
     + Generating private key...
     + Generating signing request...
     + Requesting new certificate order from CA...
     + Received 4 authorizations URLs from the CA
     + Handling authorization for preprod.site2.fr
     + Handling authorization for preprod2.site2.fr
     + Handling authorization for www.preprod.site2.fr
     + Handling authorization for preprod1.site2.fr
     + 4 pending challenge(s)
     + Deploying challenge tokens...

    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=preprod.site2.fr
       TOKEN_FILENAME=8e43b73d-8086-46ac-9a96-2654eb401c14
       TOKEN_VALUE=8e43b73d-8086-46ac-9a96-2654eb401c14.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=preprod2.site2.fr
       TOKEN_FILENAME=8b3b9c0a-4d79-4e45-a26e-dfff813689fc
       TOKEN_VALUE=8b3b9c0a-4d79-4e45-a26e-dfff813689fc.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=www.preprod.site2.fr
       TOKEN_FILENAME=a3125826-7516-448e-9614-08259a373769
       TOKEN_VALUE=a3125826-7516-448e-9614-08259a373769.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=preprod1.site2.fr
       TOKEN_FILENAME=5f08adb1-c42a-474c-af60-3cb3c9dc0961
       TOKEN_VALUE=5f08adb1-c42a-474c-af60-3cb3c9dc0961.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Responding to challenge for preprod.site2.fr authorization...
     + Challenge is valid!
     + Responding to challenge for preprod2.site2.fr authorization...
     + Challenge is valid!
     + Responding to challenge for www.preprod.site2.fr authorization...
     + Challenge is valid!
     + Responding to challenge for preprod1.site2.fr authorization...
     + Challenge is valid!
     + Cleaning challenge tokens...

    >> DEBUG (hook function: clean_challenge)
       DOMAIN=preprod.site2.fr
       TOKEN_FILENAME=8e43b73d-8086-46ac-9a96-2654eb401c14
       TOKEN_VALUE=8e43b73d-8086-46ac-9a96-2654eb401c14.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: clean_challenge)
       DOMAIN=preprod2.site2.fr
       TOKEN_FILENAME=8b3b9c0a-4d79-4e45-a26e-dfff813689fc
       TOKEN_VALUE=8b3b9c0a-4d79-4e45-a26e-dfff813689fc.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: clean_challenge)
       DOMAIN=www.preprod.site2.fr
       TOKEN_FILENAME=a3125826-7516-448e-9614-08259a373769
       TOKEN_VALUE=a3125826-7516-448e-9614-08259a373769.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: clean_challenge)
       DOMAIN=preprod1.site2.fr
       TOKEN_FILENAME=5f08adb1-c42a-474c-af60-3cb3c9dc0961
       TOKEN_VALUE=5f08adb1-c42a-474c-af60-3cb3c9dc0961.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Requesting certificate...
     + Checking certificate...
     + Done!
     + Creating fullchain.pem...

    >> DEBUG (hook function: sync_cert)
       KEYFILE=/shared/acme/certs/preprod.site2.fr/privkey-1742381897.pem
       CERTFILE=/shared/acme/certs/preprod.site2.fr/cert-1742381897.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site2.fr/fullchain-1742381897.pem
       CHAINFILE=/shared/acme/certs/preprod.site2.fr/chain-1742381897.pem
       REQUESTFILE=/shared/acme/certs/preprod.site2.fr/cert-1742381897.csr


    >> DEBUG (hook function: deploy_cert)
       DOMAIN=preprod.site2.fr
       KEYFILE=/shared/acme/certs/preprod.site2.fr/privkey.pem
       CERTFILE=/shared/acme/certs/preprod.site2.fr/cert.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site2.fr/fullchain.pem
       CHAINFILE=/shared/acme/certs/preprod.site2.fr/chain.pem
       TIMESTAMP=1742381897


    >> DEBUG (hook function: deploy_cert -> Updating existing cert and key)

    Command added to the current transaction
    Command added to the current transaction
     + Done!

    >> DEBUG (hook function: exit_hook)
       ERROR=


>> [2025-03-19_11:59:36]  DEBUG (handler function: process_handler_config)
   --domain argument specified for (preprod.site3.fr).

>> [2025-03-19_11:59:36]  DEBUG (handler function: process_handler_config)
   VAR: DOMAIN=preprod.site3.fr
   VAR: COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com -d www.preprod.site3.fr"

>> [2025-03-19_11:59:37]  DEBUG: Certificate does not exist, or ALWAYS_GENERATE_KEY is true --> call generate_new_cert_key.

>> [2025-03-19_11:59:37]  DEBUG (handler function: generate_new_cert_key)
   DOMAIN=preprod.site3.fr
   COMMAND="--ca https://acme.com/directory --config /shared/acme/config_acme.com -d www.preprod.site3.fr"

>> [2025-03-19_11:59:37]  DEBUG (handler: ACME client command):
/shared/acme/dehydrated -x -k /shared/acme/f5hook.sh -t http-01 -c -g -d preprod.site3.fr --ca https://acme.com/directory --config /shared/acme/config_acme.com -d www.preprod.site3.fr

>> [2025-03-19_12:00:26]  DEBUG (handler: ACME client output):
    # INFO: Using main config file /shared/acme/config_acme.com

    >> DEBUG (hook function: startup_hook)

    Processing preprod.site3.fr with alternative names: www.preprod.site3.fr
     + Signing domains...
     + Generating private key...
     + Generating signing request...
     + Requesting new certificate order from CA...
     + Received 2 authorizations URLs from the CA
     + Handling authorization for www.preprod.site3.fr
     + Handling authorization for preprod.site3.fr
     + 2 pending challenge(s)
     + Deploying challenge tokens...

    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=www.preprod.site3.fr
       TOKEN_FILENAME=b60ab826-1b73-4876-874a-bdd2b8077722
       TOKEN_VALUE=b60ab826-1b73-4876-874a-bdd2b8077722.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: deploy_challenge)
       DOMAIN=preprod.site3.fr
       TOKEN_FILENAME=33043cfe-2c7b-42d5-a638-6dda40c1ddf1
       TOKEN_VALUE=33043cfe-2c7b-42d5-a638-6dda40c1ddf1.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Responding to challenge for www.preprod.site3.fr authorization...
     + Challenge is valid!
     + Responding to challenge for preprod.site3.fr authorization...
     + Challenge is valid!
     + Cleaning challenge tokens...

    >> DEBUG (hook function: clean_challenge)
       DOMAIN=www.preprod.site3.fr
       TOKEN_FILENAME=b60ab826-1b73-4876-874a-bdd2b8077722
       TOKEN_VALUE=b60ab826-1b73-4876-874a-bdd2b8077722.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA


    >> DEBUG (hook function: clean_challenge)
       DOMAIN=preprod.site3.fr
       TOKEN_FILENAME=33043cfe-2c7b-42d5-a638-6dda40c1ddf1
       TOKEN_VALUE=33043cfe-2c7b-42d5-a638-6dda40c1ddf1.m9nHffzxu1ZvLrCVyZJWOnIoggtCZC6DmWTW4K5_ABA

     + Requesting certificate...
     + Checking certificate...
     + Done!
     + Creating fullchain.pem...

    >> DEBUG (hook function: sync_cert)
       KEYFILE=/shared/acme/certs/preprod.site3.fr/privkey-1742381980.pem
       CERTFILE=/shared/acme/certs/preprod.site3.fr/cert-1742381980.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site3.fr/fullchain-1742381980.pem
       CHAINFILE=/shared/acme/certs/preprod.site3.fr/chain-1742381980.pem
       REQUESTFILE=/shared/acme/certs/preprod.site3.fr/cert-1742381980.csr


    >> DEBUG (hook function: deploy_cert)
       DOMAIN=preprod.site3.fr
       KEYFILE=/shared/acme/certs/preprod.site3.fr/privkey.pem
       CERTFILE=/shared/acme/certs/preprod.site3.fr/cert.pem
       FULLCHAINFILE=/shared/acme/certs/preprod.site3.fr/fullchain.pem
       CHAINFILE=/shared/acme/certs/preprod.site3.fr/chain.pem
       TIMESTAMP=1742381980


    >> DEBUG (hook function: deploy_cert -> Updating existing cert and key)

    Command added to the current transaction
    Command added to the current transaction
     + Done!

    >> DEBUG (hook function: exit_hook)
       ERROR=


>> [2025-03-19_12:00:27]  DEBUG START/END account checksums detects no changes - not pushing account state data to iFile central store

>> [2025-03-19_12:00:27]  DEBUG START/END config checksums are different or iFile state is missing - pushing config state data to iFile central store

>> [2025-03-19_12:00:28]  DEBUG START/END config checksums are different and FORCE_SYNC is set to true - forcing an HA sync operation

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions