Certmgr should verify that a preexisting cert matches the spec provided

[cloudflare]

Certmgr should verify that a preexisting cert matches the spec provided

[Kellel]

This might be a dupe of #9

[ferringb]

At this point, certmgr will regenerate any cert/key/ca if the spec has an mtime newer than that content. There should be an additional CA comparison check iirc, but consider it equivalent.

That's the mechanism it uses to track state; if a spec is dropped in place that has an old mtime, it's not going to fly.

Either way... I think the issue you're running into is probably resolved already in recent certmgr instances. One debug tip- if the spec doesn't specify a restart/reload for the service consuming the cert, then even if the spec changes (and cert/key is regenerated) the service keeps uses the cert's it loaded into memory.

That 'gotcha' is very, very frequently overlooked.

[ferringb]

Closing this out; in general, certmgr doesn't validate that the pki it wrote to disk in previous runs still matches the new CA it fetches.

This seems to be an intentional design decision; I'm not a huge fan of it, but wiring the validation in is likely non trivial. If someone wishes to take a stab at it, patches welcome however.

[ferringb]

Note: the ticket linkage wasn't handled fully, but this is fixed in current certmgr master branch via @anita-tenjarla 's validation work, and my tweaks to wire those checks in as a way to force regeneration.

Expect this work to be released in the 2.0 version of certmgr