dovecot - Sep 2022 - Thousands of SSL certificates stalls new logins during reload - problem with Dovecot config process

On 02/09/2022 22:45, John Stoffel wrote:>>>>>>
"Bartosz" == Bartosz
Kwitniewski <zerg-dovecot at uid0.pl> writes:
 >
 >> Out of other services on that machine that are able to handle such
 >> number of certificates during reloads:
 >> - proftpd loads configs dynamically based on SNI domain
 >> - exim loads certificates dynamically based on SNI domain
 >> - LiteSpeed switches to a new process after loading whole
configuration
 >
 > Are you running all these services on one machine?  Maybe you could
 > get an SSL termination device which terminates the SSL connections and
 > then forwards them into the proper backend application?  This way only
 > one system needs to be managed for certs, and only one (or two since I
 > assume you have an HA pair :-) needs to then reload when new certs are
 > inserted.
 >
 > If you could hack the proftpd cert code into dovecot, that might also
 > be a way around it.  I haven't a clue how this works since I
haven't
 > looked at either code base.  It won't be simple, but I'm sure
others
 > would apprecaite it.
 >
 > If it's critical, paying for the feature to be added is another
 > option.
 >
 >
For now they are on the same machine, we have to write our own panel for 
clients to get more freedom in backend choices. I was looking into 
HAProxy for SSL termination, but it does not support STARTTLS.

I'll try to look for workaround next week, but haven't used C for ages.

Best regards,
--
Bartosz Kwitniewski

04.09.2022 01:01:16 Bartosz Kwitniewski <zerg-dovecot at uid0.pl>:

> For now they are on the same machine, we have to write our own panel for
clients to get more freedom in backend choices. I was looking into HAProxy for
SSL termination, but it does not support STARTTLS.
>
> I'll try to look for workaround next week, but haven't used C for
ages.
>
> Best regards,
> --
> Bartosz Kwitniewski
Nginx can be used as reverse proxy for dovecot to terminate tls and load
balance. It can also be used to verify client certificates (access only with
valid client certificate and route access to backend based on client
certificate).

Cheers,
spi