Ejabberd: Support reloading TLS certificate file

[nomis]

Let's Encrypt certificates expire after 90 days, there needs to be a command to reload the certificate without having to restart the server.

[weiss]

ejabberd reloads the certificate automatically if the modification time of the PEM file changes.

[ghost]

@weiss Could you say more about how that feature works, e.g. where exactly the check is done? It's not exactly easy to find any information about it.

Edit, found it: the fast_tls library checks this whenever tcp_to_tls() is called.

[dioobr]

@weiss How long to verify that the certificate has been replaced? I did this now, and still continues with the expired certificate.

[weiss]

How long to verify that the certificate has been replaced?

It should be auto-reloaded immediately.

I did this now, and still continues with the expired certificate.

WIth recent ejabberd versions, you might have to call ejabberdctl reload-config after replacing the certificate (if you're on Linux and don't have inotifywait installed, or if you're e.g. on a BSD).

[paradisaeidae]

I've attempted to refresh certificates using: ejabberdctl reload-config
However with 18.09 this has no effect if a directory is used in config.

[zinid]

However with 18.09 this has no effect if a directory is used in config.

What do you mean? Show your certfiles section.

[paradisaeidae]

certfiles:
  - "/aDirectory/path/to/somewhere/*"

This is very early in my config. Line 21.
It has been very effective as I do not have to nominate individual certs anywhere else.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.