me0nline/LOGAR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

docs: document certificate validity watchdog and auto-renewal in root README.md

Browse Source
This commit is contained in:
me0nline
2026-09-04 22:54:25 +02:00
parent c01c09ecbd
commit c9f769ef2b
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -114,6 +114,15 @@ graph TB
- If `active_seats >= max_seats`, the hub rejects registration with `HTTP 403 (License seat limit reached)`. - If `active_seats >= max_seats`, the hub rejects registration with `HTTP 403 (License seat limit reached)`.
- Existing registered clients can re-enroll / renew seamlessly without consuming additional seats. - Existing registered clients can re-enroll / renew seamlessly without consuming additional seats.
### 4. In-Flight Certificate Watchdog & Automated Self-Healing Renewal
- **Continuous Hub PKI Watchdog**:
- The server hub runs a continuous background watchdog coroutine (`cert_validity_watchdog`, running every 12 hours) alongside startup checks.
- The hub automatically inspects expiration dates of both the Root CA (`ca.crt`) and the Server TLS certificate (`server.crt`).
- If either certificate is within 30 days of expiration, the server regenerates certificates (backing up previous keys as `ca.crt.<timestamp>.bak`) and dynamically reloads its active `ssl.SSLContext` in memory without dropping socket connections or restarting the service.
- **Client Proactive Check & Reactive Self-Healing**:
- **Proactive Renewal**: Edge clients inspect `client.crt` before every run cycle. If the certificate expires in less than 30 days, it automatically contacts `/api/client/enroll` to renew its certificate.
- **Reactive Self-Healing**: If the server hub Root CA rotates or a handshake fails with `ssl.SSLError` / `SSLCertVerificationError`, edge clients catch the verification exception, re-bootstrap certificate enrollment against the hub, and re-establish the connection cleanly without human intervention.
--- ---
## Cloud-Side Temporal Persistence & 4-Run Rule ## Cloud-Side Temporal Persistence & 4-Run Rule