- Shipped
- July 22, 2026 at 2:26 PM UTC
- Author
- Kamo
- Commit
- f62bccf
update_tls_store() rebuilt the TLSStore from a plain Secret listing, bucketed only on name prefix and type, with no check that a Certificate still owned the secret and no check of notAfter. wildcard-kamocrm-com was orphaned when ensure_host_certificate() repointed kamocrm-com-cert from wildcard-kamocrm-com to tls-kamocrm-com: it derives cert_name purely from the FQDN, and its early-return compares dnsNames and privateKey but never secretName, so the apply rewrote spec.secretName in place. cert-manager does not delete a secret it has been repointed away from, so nothing renewed the old one. It expired 2026-07-20 and — still being republished into the store every reconcile — won SNI over the fresh per-host certs for all 16 names it listed. **************** capcha.kamocrm.com each served an expired certificate while a valid, unexpired replacement sat unused in the same store. update_tls_store() now: - excludes any secret past notAfter, checked with `openssl -checkend 0` rather than the 30-day is_cert_expired(), so a cert in its renewal window is never yanked out of Traefik while still valid - excludes legacy wildcard-* secrets that no Certificate owns - drops legacy multi-SAN certs whose names are fully covered by per-host certs, eliminating duplicate SNI coverage instead of relying on store ordering to break the tie All three guards fail open, so a failed lookup or unreadable cert preserves current behaviour and can never drop a live cert. ensure_host_certificate() now logs when it repoints a Certificate, so future orphans are visible rather than silent. Verified against a snapshot of live cluster state: 177 -> 165 certificates, all 12 legacy multi-SAN entries retired (6 expired, 6 fully superseded), and no live host loses coverage.