NethVoice TLS certificate-changed handler

[DavidePrincipi]

Nethserver Core 3.6.0 implements a new event and API for TLS certificates management that supports certificates with SAN and wildcard names, #7004.

For security, the new implementation does not store the certificate private key in Redis. Apps with Traefik's "certadm" authorization must invoke Traefik's get-certificate action to obtain the certificate and private key.

The currently implemented event handler, certificate-updated is deprecated and will be removed in future releases and Redis keys with cert and key will be removed.

Proposed solution

Implement the new behavior in NethVoice and NethVoice Proxy.

See also

• https://nethserver.github.io/ns8-core/modules/certificates/#tls-for-other-applications
• https://nethserver.github.io/ns8-core/core/proxy_certificates/

---

Thanks to @Amygos

[DavidePrincipi]

Test case 1

• Install nethvoice-proxy and nethvoice testing versions
• Enable Let's Encrypt certificates

The services must use the expected LE certificates

Test case 2

• Upload certificates with names that match the services. See the Traefik README to disable the chain validator.

The services must automatically reconfigure with the uploaded certificates

Test case 3

Like test case 2, with the upload of a wildcard certificate.

Test case 4

• Annotate the certificate currently used by services.
• Update an existing system.

After the update and services restart the certificates are unchanged.

Test case 5

Check that services are restarted successfully after receiving a certificate-changed event. To simulate an event run:

redis-cli publish module/traefik1/event/certificate-changed '{"node_id":1,"module_id":"traefik1","names":["nethvoice.dp.nethserver.net","nethvoice-proxy.dp.nethserver.net"]}'