action #134522
closed[alert] Certificate renewal on monitor.qa.suse.de might not be working causing alerts size:M
0%
Description
Observation¶
According to https://stats.openqa-monitor.qa.suse.de/d/E9tyiQ17k/ssl-certificate-alerts?orgId=1 the SAN validity of the certificate on monitor.qa.suse.de is going to expire in less than 5 days. I've checked the certificate via martchus@monitor:~> sudo openssl x509 -noout -text -in /etc/dehydrated/certs/monitor.qa.suse.de/fullchain.pem
and it is indeed going to expire on Aug 28 22:23:02 2023 GMT. Firefox tells me the same if I access https://stats.openqa-monitor.qa.suse.de.
The dehydrated timer was executed successfuly but a manual run of dehydrated --cron
shows that dehydrated just hangs.
Acceptance Criteria¶
- AC1: A new certificate is known to be avaialble and used
- AC2: It is understood what the cause was and how to avoid it next time
Suggestions¶
- Check why the certificate expiration is not renewed to be higher than 5 days, e.g. problems with
dehydrated.service
. - Understand why dehydrated hangs and does not produce a new certificate
- Check if we can make the issue (whatever it is) better visible or workaround automatically in the future
Updated by nicksinger over 1 year ago
- Assignee changed from mkittler to nicksinger
- Priority changed from Normal to Urgent
Given that the certificate will run out in just a few days I bump the prio
Updated by livdywan over 1 year ago
- Tags changed from alert to alert, infra
- Subject changed from [alert] Certificate renewal on monitor.qa.suse.de might not be working causing alerts to [alert] Certificate renewal on monitor.qa.suse.de might not be working causing alerts size:M
- Description updated (diff)
Updated by openqa_review over 1 year ago
- Due date set to 2023-09-07
Setting due date based on mean cycle time of SUSE QE Tools
Updated by nicksinger over 1 year ago
- Status changed from In Progress to Feedback
Updated by livdywan over 1 year ago
- Related to action #134819: Errors in salt minion and master log on osd added
Updated by livdywan over 1 year ago
- Status changed from Feedback to Resolved
High state looks good and certificate renewal seems to be working again as discussed in the unblock
Updated by livdywan 2 months ago
- Copied to action #167458: openqa.oqa.prg2.suse.org SAN validity alert added