[pfx] Re: server does not pick up new certificates

2023-07-25 Thread Olivier via Postfix-users
lejeczek via Postfix-users writes: > On 23/07/2023 22:44, Viktor Dukhovni via Postfix-users wrote: >> On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users >> wrote: >> >>> In the case of the dehydrated ACME client >>> (https://github.com/dehydrated-io/dehydrated) there's an option to

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread lejeczek via Postfix-users
On 23/07/2023 22:44, Viktor Dukhovni via Postfix-users wrote: On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users wrote: In the case of the dehydrated ACME client (https://github.com/dehydrated-io/dehydrated) there's an option to run a bunch of commands on successful update, in

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread raf via Postfix-users
On Mon, Jul 24, 2023 at 09:49:58AM -0400, Wietse Venema via Postfix-users wrote: > Bernardo Reino via Postfix-users: > > >> I cannot imagine why/when the cerbot client would fail to run the > > >> post-hooks (in a sane environment). > > > > > > Systems crash. What are the reliability guarantees

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread Wietse Venema via Postfix-users
Bernardo Reino via Postfix-users: > >> I cannot imagine why/when the cerbot client would fail to run the > >> post-hooks (in a sane environment). > > > > Systems crash. What are the reliability guarantees from the certbot > > client: will it run once, or will it somehow maintain state and > > reco

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread Viktor Dukhovni via Postfix-users
On Mon, Jul 24, 2023 at 03:27:34PM +0200, Bernardo Reino via Postfix-users wrote: > > Systems crash. What are the reliability guarantees from the certbot > > client: will it run once, or will it somehow maintain state and > > recover when a run was interrupted by a system crash? > > In such cas

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread Bernardo Reino via Postfix-users
On Mon, 24 Jul 2023, Wietse Venema via Postfix-users wrote: Bernardo Reino via Postfix-users: On Sun, 23 Jul 2023, Viktor Dukhovni via Postfix-users wrote: On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users wrote: In the case of the dehydrated ACME client (https://github.com/

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread Wietse Venema via Postfix-users
Bernardo Reino via Postfix-users: > On Sun, 23 Jul 2023, Viktor Dukhovni via Postfix-users wrote: > > > On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users > > wrote: > > > >> In the case of the dehydrated ACME client > >> (https://github.com/dehydrated-io/dehydrated) there's an opti

[pfx] Re: server does not pick up new certificates

2023-07-24 Thread Bernardo Reino via Postfix-users
On Sun, 23 Jul 2023, Viktor Dukhovni via Postfix-users wrote: On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users wrote: In the case of the dehydrated ACME client (https://github.com/dehydrated-io/dehydrated) there's an option to run a bunch of commands on successful update, incl

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Viktor Dukhovni via Postfix-users
On 23 Jul 2023, at 4:21 pm, Charles Sprickman via Postfix-users wrote: > In the case of the dehydrated ACME client > (https://github.com/dehydrated-io/dehydrated) there's an option to run > a bunch of commands on successful update, including something like > "postfix reload" - one could also ins

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Charles Sprickman via Postfix-users
> On Jul 23, 2023, at 2:29 PM, Viktor Dukhovni via Postfix-users > wrote: > > On Sun, Jul 23, 2023 at 08:18:21PM +0200, lejeczek via Postfix-users wrote: > >>> You need to rebuild it periodically. Once a week should be enough, >>> ACME certificates are typically good for 90 days and get rep

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Viktor Dukhovni via Postfix-users
On Sun, Jul 23, 2023 at 08:18:21PM +0200, lejeczek via Postfix-users wrote: > > You need to rebuild it periodically. Once a week should be enough, > > ACME certificates are typically good for 90 days and get replaced > > every 60, so when the new one is minted the old one is still good > > for 30

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread lejeczek via Postfix-users
On 23/07/2023 18:50, Viktor Dukhovni via Postfix-users wrote: On Sun, Jul 23, 2023 at 09:39:52AM +0200, lejeczek via Postfix-users wrote: What is "snis.map", and how is it used in your configuration? tls_server_sni_maps = hash:/etc/postfix/snis.map And when did you run as root: # pos

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Viktor Dukhovni via Postfix-users
On Sun, Jul 23, 2023 at 09:39:52AM +0200, lejeczek via Postfix-users wrote: > > What is "snis.map", and how is it used in your configuration? > > tls_server_sni_maps = hash:/etc/postfix/snis.map And when did you run as root: # postmap -F hash:/etc/postfix/snis.map to update that table?

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Wietse Venema via Postfix-users
lejeczek via Postfix-users: > > > On 23/07/2023 16:00, Wietse Venema wrote: > > lejeczek via Postfix-users: > >> -> $ postfix reload # did not work, new certs/files where > >> only picked up with "full" restart, with "systemd" in this case. > >> > >> and when done, then server-postifx supplied ne

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread lejeczek via Postfix-users
On 23/07/2023 16:00, Wietse Venema wrote: lejeczek via Postfix-users: -> $ postfix reload # did not work, new certs/files where only picked up with "full" restart, with "systemd" in this case. and when done, then server-postifx supplied new certs immediately - clients where happy. I was thin

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread lejeczek via Postfix-users
On 23/07/2023 16:00, Wietse Venema wrote: lejeczek via Postfix-users: -> $ postfix reload # did not work, new certs/files where only picked up with "full" restart, with "systemd" in this case. and when done, then server-postifx supplied new certs immediately - clients where happy. I was thi

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread Wietse Venema via Postfix-users
lejeczek via Postfix-users: > -> $ postfix reload # did not work, new certs/files where > only picked up with "full" restart, with "systemd" in this case. > > and when done, then server-postifx supplied new certs > immediately - clients where happy. > > I was thinking "glitch" for perhaps SElin

[pfx] Re: server does not pick up new certificates

2023-07-23 Thread lejeczek via Postfix-users
On 20/07/2023 21:14, Viktor Dukhovni via Postfix-users wrote: On Thu, Jul 20, 2023 at 07:11:41PM +0200, lejeczek via Postfix-users wrote: I use what I believe is pretty much vanilla-common setup - snis.map I had to restart the deamon/server in order for _postix_ to notice new certs - natural

[pfx] Re: server does not pick up new certificates

2023-07-20 Thread Viktor Dukhovni via Postfix-users
On Thu, Jul 20, 2023 at 07:11:41PM +0200, lejeczek via Postfix-users wrote: > I use what I believe is pretty much vanilla-common setup - snis.map I > had to restart the deamon/server in order for _postix_ to notice new > certs - naturally located in same one place - reload did not do. What is "sn