Skip to content

Retry the origin verification, which raced its own nginx reload #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralyodio merged 1 commit into from
Aug 1, 2026
Merged

Retry the origin verification, which raced its own nginx reload #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions scripts/setup-origin.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,12 +139,29 @@ fi
# running server what it actually presents for this name.
if [ "$DRY_RUN" = "0" ]; then
step "checking what the server now presents for $NAME"
presented=$(echo | openssl s_client -connect 127.0.0.1:443 -servername "$NAME" 2>/dev/null \
| openssl x509 -noout -subject 2>/dev/null || true)

# Retried, because `nginx -s reload` returns as soon as the signal is sent,
# not when the new workers are serving. The old workers finish their existing
# connections first, so a check fired immediately gets answered by the config
# from *before* the reload — which looks exactly like the default-vhost bug
# this is here to catch. Found the hard way: the first live run of this script
# reported a name mismatch that had already been fixed.
presented=""
attempt=1
while [ "$attempt" -le 5 ]; do
presented=$(echo | openssl s_client -connect 127.0.0.1:443 -servername "$NAME" 2>/dev/null \
| openssl x509 -noout -subject 2>/dev/null || true)
case "$presented" in
*"$NAME"*) break ;;
esac
sleep 1
attempt=$((attempt + 1))
done

case "$presented" in
*"$NAME"*) say " ${DIM}$presented${OFF}" ;;
"") warn "could not read a certificate back from 127.0.0.1:443" ;;
*) warn "the server answered '$NAME' with: $presented"
*) warn "after 5 tries the server still answers '$NAME' with: $presented"
warn "another server block is matching first — check for a default_server" ;;
esac
fi
Expand Down
Loading