mirror of
https://github.com/tailscale/tailscale.git
synced 2024-11-25 19:15:34 +00:00
c1ecae13ab
While our `shouldStartDomainRenewal` check is correct, `getCertPEM` would always bail if the existing cert is not expired. Add the same `shouldStartDomainRenewal` check to `getCertPEM` to make it proceed with renewal when existing certs are still valid but should be renewed. The extra check is expensive (ARI request towards LetsEncrypt), so cache the last check result for 1hr to not degrade `tailscale serve` performance. Also, asynchronous renewal is great for `tailscale serve` but confusing for `tailscale cert`. Add an explicit flag to `GetCertPEM` to force a synchronous renewal for `tailscale cert`. Fixes #8725 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> |
||
|---|---|---|
| .. | ||
| ipnauth | ||
| ipnlocal | ||
| ipnserver | ||
| ipnstate | ||
| localapi | ||
| policy | ||
| store | ||
| backend.go | ||
| doc.go | ||
| fake_test.go | ||
| ipn_clone.go | ||
| ipn_view.go | ||
| prefs_test.go | ||
| prefs.go | ||
| serve_test.go | ||
| serve.go | ||
| store.go | ||