On Wed, Oct 21, 2026 at 04:09:28PM +0200, Rafael Sadowski wrote:
> I think the better fix is in the parent. It starts a rekey timer for
> every TLS server, but only the first server on an address/port gets a
> struct server in the server processes. The diff below starts the timer
> ONLY for that one.
>
> Tested with two TLS servers on the same socket: the "ignoring rekey"
> messages from James' diff are gone. What I believe is the right
> solution.
>
> It annoys me that this bug made it into version 8.0, but the problem
> actually reveals the real flaw.
>
> OK?
Ok by me, thanks!
> diff --git a/httpd.c b/httpd.c
> index abfbb5c..6ca2e24 100644
> --- a/httpd.c
> +++ b/httpd.c
> @@ -298,7 +298,8 @@ parent_configure(struct httpd *env)
> continue;
> /* start the rekey of the tls ticket keys */
> if (srv->srv_conf.flags & SRVFLAG_TLS &&
> - srv->srv_conf.tls_ticket_lifetime)
> + srv->srv_conf.tls_ticket_lifetime &&
> + server_match(srv, 0) == srv)
> parent_tls_ticket_rekey_start(srv);
> if (config_setserver(env, srv) == -1)
> fatal("send server");
>
>
