From c9f769ef2b25fca7fa3ec39e6c671379d491b037 Mon Sep 17 00:00:00 2001 From: max Date: Fri, 4 Sep 2026 22:54:25 +0200 Subject: [PATCH] docs: document certificate validity watchdog and auto-renewal in root README.md --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index 504b1a0..93879eb 100644 --- a/README.md +++ b/README.md @@ -114,6 +114,15 @@ graph TB - If `active_seats >= max_seats`, the hub rejects registration with `HTTP 403 (License seat limit reached)`. - Existing registered clients can re-enroll / renew seamlessly without consuming additional seats. +### 4. In-Flight Certificate Watchdog & Automated Self-Healing Renewal +- **Continuous Hub PKI Watchdog**: + - The server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, running every 12 hours) alongside startup checks. + - The hub automatically inspects expiration dates of both the Root CA (`ca.crt`) and the Server TLS certificate (`server.crt`). + - If either certificate is within 30 days of expiration, the server regenerates certificates (backing up previous keys as `ca.crt..bak`) and dynamically reloads its active `ssl.SSLContext` in memory without dropping socket connections or restarting the service. +- **Client Proactive Check & Reactive Self-Healing**: + - **Proactive Renewal**: Edge clients inspect `client.crt` before every run cycle. If the certificate expires in less than 30 days, it automatically contacts `/api/client/enroll` to renew its certificate. + - **Reactive Self-Healing**: If the server hub Root CA rotates or a handshake fails with `ssl.SSLError` / `SSLCertVerificationError`, edge clients catch the verification exception, re-bootstrap certificate enrollment against the hub, and re-establish the connection cleanly without human intervention. + --- ## Cloud-Side Temporal Persistence & 4-Run Rule