On Fri, Jun 19, 2020 at 04:45:33PM +0300, tbn wrote: > Hello William, > > Thank you for your quick reply. You're right, it works flawlessly > after adding it to a crt-list, as Bjoern also mentioned.
Good to know! Well, I'll start by updating the "commit ssl cert" documentation which is ambiguous since we introduced the ability to add new certificates instead of replacing existing ones, that's probably the documentation that confused you in the first place. > After reading the documentation, I was under the impression the > crt-list didn't support folders (although folder support is mentioned > there), mainly because I was trying to add "/etc/haproxy/ssl/" <- with > the trailing slash and always ended up in an error: Oh, that's bad, I should definitely improve that. In fact, in haproxy 2.2 the folders are implemented as crt-lists, it's just a specific case of a crt-list where you can't have the same file twice and you can't have a specific configuration per file. > > ------------------------------------------------------[Start]------------------------------------------------------ > ]# echo "add ssl crt-list /etc/haproxy/ssl/ > /etc/haproxy/ssl/bar.com.pem" | socat /tmp/stats stdio > Can't edit the crt-list: crt-list '/etc/haproxy/ssl/' does not exist! > ------------------------------------------------------[End]------------------------------------------------------ > > After reading your reply, I tried removing the trailing slash, > just like it was specified in the config file, and it worked. In my > mind the logic was "the trailing slash is what makes it consider the > path as a folder instead of a file" and stuck to that. > Thank you for your help and replies, this is a very interesting > approach to loading/unloading certificates without the need to restart > the instance. > You are right, currently you should use the exact path as seen in "show ssl crt-list", the command was for crt-lists only at the beginning. Thanks for the feebacks, I'm going to improve both the documentation and the parsing of the command line. -- William Lallemand
