Cert expired checker #2
Conversation
…its own package called lnencrypt The functions inside of the crypto.go file in chanbackup (like EncryptPayloadToWriter and DecryptPayloadFromReader) can be used by a lot of things outside of just the chanbackup package. We can't just reference them directly from the chanbackup package because it's likely that it would generate circular dependencies. Therefore we need to move these functions into their own package to be referenced by chanbackup and whatever new functionality that needs them
This commit adds support in lnd to encrypt the TLS private key on disk with the wallet's seed. This obviously causes issues when the wallet is locked. So for the WalletUnlocker RPC we generate ephemeral TLS certificates with the key stored in memory. This feature is enabled with the --tlsencryptkey flag.
… from the beginning
|
@gkrizek Hey there! I tried to submit this PR to getvoltage/lnd but git wouldn't let me so I just put it here for now. Wanted to check to see if this looks on the right track to you I think it's mostly done but I'm still working on testing DeleteAndRegenerateCert. For that... I was wondering if you could give me an example output of the full JSON that the download endpoint gives (https://zerossl.com/documentation/api/download-certificate-inline/), since the example they provide doesn't seem to show the whole thing & I guess I can't use the API as a non-paying user :P |
|
@orbitalturtle Thanks! Ok I'm heading out right now, but I'll review this tonight and get you that response. |
|
@gkrizek awesome thanks! |
|
@orbitalturtle you should also open this PR into the |
|
@gkrizek Gotcha, here this should be easier to read: voltagecloud/lnd#4 |
Builds on top of #3. This change checks once a day whether the zerossl certificate is expiring in three days. If it is, it regenerates a new one
Also refactors zerossl into an interface to make it easier to mock.
Finally, factors out logic for deleting the temporary certificate into the function DeleteAndRegenerateCert, which we'll also use for deleting/regenerating an expiring certificate. Still working on testing this piece