[Feature Request] A restful API for certificate renew

KVM
1

Request

Add a restful API for a remote renewal of the server TLS certificates for https connections.

Justification

It is 2026. https is required for a web server. As the length of the validation period of server certificates is getting shorter:

  • Currently it is 200 days.
  • It will be reduced further to 100 days on March 15, 2027 and,
  • it becomes 47 days on March 15, 2029.

It is impractical to renew TLS certificatebes manually. It should be done automatically.

There is no official way to renew TLS certificate automatically on Comet.

My current solution is running a crontask on another machine in order to

  1. generate the certificates and
  2. rsync to the files to the Comet GL-RM1.
  3. Restart the KVM by calling /etc/init.d/S99kvmd-nginx reload via ssh.

As expected it has not been running smoothly as the required components have been modified on every firmware update until recently.

It is essential to have an official solution for a scriptable renewal of the TLS certificates.

2 Likes
3

A self signed certificate doesn't need to be renewed that often, even if exposed publicly.

4

Hi, thanks for the feedback. We've noted that and will evaluate it.

1 Like
5

I'd also love this. I push a wildcard cert to my devices, and currently my renewal script uses SCP to push the cert to the right location on certain devices. But this is fragile, software updates sometimes change the cert location or format. An API call to update the cert would be much more robust.

6

Self-signed certs provide encryption, which is great, but don't have an easy mechanism to provide authentication. It's a better security posture to make sure the browser config doesn't need to be updated to avoid cert warnings. While I could use my Vault instances to run a local CA, that's a big security gap in that X.509 certs are trusted if ANY CA accepts the cert. So if my Vault instance is hacked I'd wind up trusting certs from all over the Internet if I haven't already pinned them. While I'm a small target, I don't have the audits that someone like LetsEncrypt has to ensure there's no drive-by exploits I've fallen victim to. Yes, this implies a more targeted attack, but an API to update certs is an easy ask to close a gap in the security profile.

7

Thanks for your suggestion.

However, I don’t share your mindset of fighting over the domain experts and the best practice.