Certificates: help.sh validates the CA and leaf certs; fix renew exec bit.

Browse source

help.sh now detects invalid Caddy certificates: expired or unparseable
CA/leaf certs, a leaf expiring within 30 days, a leaf that does not match
its private key or the current hostname, and Caddy serving a stale cert
after regeneration.  It also checks that the renewal script is executable
and its timer is enabled.

scripts/renew_certificates.sh was committed without the executable bit,
so wrolpi-cert-renew.service failed with "Permission denied".  Set the
bit and make repair.sh restore executable bits on all scripts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

...

This commit is contained in:

Roland 2026-07-09 15:28:54 -06:00 • committed by lrnselfreliance

parent b172a4c9d6

commit d6b019c24e

3 changed files with 68 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

0

scripts/renew_certificates.sh Normal file → Executable file

Unescape Escape View file