Reload TLS certificate from disk, effectively rotating it */
| 451 | |
| 452 | /* Reload TLS certificate from disk, effectively rotating it */ |
| 453 | void tlsReload(void){ |
| 454 | /* We will only bother checking keys and certs if TLS is enabled, otherwise we would be calling 'stat' for no reason */ |
| 455 | if (g_pserver->tls_rotation && (g_pserver->tls_port || g_pserver->tls_replication || g_pserver->tls_cluster)){ |
| 456 | |
| 457 | bool cert_file_modified = getLastModifiedTime(g_pserver->tls_ctx_config.cert_file) != g_pserver->tls_ctx_config.cert_file_last_modified; |
| 458 | bool key_file_modified = getLastModifiedTime(g_pserver->tls_ctx_config.key_file) != g_pserver->tls_ctx_config.key_file_last_modified; |
| 459 | |
| 460 | bool client_cert_file_modified = g_pserver->tls_ctx_config.client_cert_file != NULL && getLastModifiedTime(g_pserver->tls_ctx_config.client_cert_file) != g_pserver->tls_ctx_config.client_cert_file_last_modified; |
| 461 | bool client_key_file_modified = g_pserver->tls_ctx_config.client_key_file != NULL && getLastModifiedTime(g_pserver->tls_ctx_config.client_key_file) != g_pserver->tls_ctx_config.client_key_file_last_modified; |
| 462 | |
| 463 | bool ca_cert_file_modified = g_pserver->tls_ctx_config.ca_cert_file != NULL && getLastModifiedTime(g_pserver->tls_ctx_config.ca_cert_file) != g_pserver->tls_ctx_config.ca_cert_file_last_modified; |
| 464 | bool ca_cert_dir_modified = g_pserver->tls_ctx_config.ca_cert_dir != NULL && getLastModifiedTime(g_pserver->tls_ctx_config.ca_cert_dir) != g_pserver->tls_ctx_config.ca_cert_dir_last_modified; |
| 465 | |
| 466 | if (cert_file_modified || key_file_modified || ca_cert_file_modified || ca_cert_dir_modified || client_cert_file_modified || client_key_file_modified){ |
| 467 | serverLog(LL_NOTICE, "TLS certificates changed on disk, attempting to rotate."); |
| 468 | if (tlsConfigure(&g_pserver->tls_ctx_config) == C_ERR) { |
| 469 | serverLog(LL_NOTICE, "Error trying to rotate TLS certificates, TLS credentials remain unchanged."); |
| 470 | } else { |
| 471 | serverLog(LL_NOTICE, "TLS certificates rotated successfully."); |
| 472 | } |
| 473 | } |
| 474 | } |
| 475 | } |
| 476 | |
| 477 | #ifdef TLS_DEBUGGING |
| 478 | #define TLSCONN_DEBUG(fmt, ...) \ |
no test coverage detected