PRIVATE_KEY_RENEW="no" ignored? #261

New Issue

adam · 2025-12-29T01:20:29+01:00

adam commented

2025-12-29 01:20:29 +01:00

Originally created by @bortzmeyer on GitHub (Oct 25, 2017).

I want to renew the certificate without changing the key, to use things like DANE or HTTP key pinning. I therefore added:

PRIVATE_KEY_RENEW="no"

to /etc/dehydrated/config. Nevertheless, the key is changed when renewal.

Here is the output of dehydrated:


# INFO: Using main config file /etc/dehydrated/config
# !! WARNING !! Extra configuration directory /etc/dehydrated/conf.d exists, but no
+configuration found in it.
Processing mercredifiction.bortzmeyer.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Nov 22 08:40:00 2017 GMT Certificate will expire
(Less than 30 days). Renewing!
 + Signing domains...
 + Generating signing request...
 + Requesting challenge for mercredifiction.bortzmeyer.org...
 + Responding to challenge for mercredifiction.bortzmeyer.org...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
Reloading apache2 configuration (via systemctl): apache2.service.
 + Done!

And here is the full config:

% cat /etc/dehydrated/config     
#############################################################
# This is the main config file for dehydrated               #
#                                                           #
# This is the default configuration for the Debian package. #
# To see a more comprehensive example, see                  #
# /usr/share/doc/dehydrated/examples/config                 #
#                                                           #
# For details please read:                                  #
# /usr/share/doc/dehydrated/README.Debian                   #
#############################################################

CONFIG_D=/etc/dehydrated/conf.d
BASEDIR=/var/lib/dehydrated
WELLKNOWN="${BASEDIR}/acme-challenges"
DOMAINS_TXT="/etc/dehydrated/domains.txt"
# Keep the key, for DANE
PRIVATE_KEY_RENEW="no"

Originally created by @bortzmeyer on GitHub (Oct 25, 2017). I want to renew the certificate without changing the key, to use things like DANE or HTTP key pinning. I therefore added: ``` PRIVATE_KEY_RENEW="no" ``` to /etc/dehydrated/config. Nevertheless, the key is changed when renewal. Here is the output of dehydrated: ``` # INFO: Using main config file /etc/dehydrated/config # !! WARNING !! Extra configuration directory /etc/dehydrated/conf.d exists, but no +configuration found in it. Processing mercredifiction.bortzmeyer.org + Checking domain name(s) of existing cert... unchanged. + Checking expire date of existing cert... + Valid till Nov 22 08:40:00 2017 GMT Certificate will expire (Less than 30 days). Renewing! + Signing domains... + Generating signing request... + Requesting challenge for mercredifiction.bortzmeyer.org... + Responding to challenge for mercredifiction.bortzmeyer.org... + Challenge is valid! + Requesting certificate... + Checking certificate... + Done! + Creating fullchain.pem... Reloading apache2 configuration (via systemctl): apache2.service. + Done! ``` And here is the full config: ``` % cat /etc/dehydrated/config ############################################################# # This is the main config file for dehydrated # # # # This is the default configuration for the Debian package. # # To see a more comprehensive example, see # # /usr/share/doc/dehydrated/examples/config # # # # For details please read: # # /usr/share/doc/dehydrated/README.Debian # ############################################################# CONFIG_D=/etc/dehydrated/conf.d BASEDIR=/var/lib/dehydrated WELLKNOWN="${BASEDIR}/acme-challenges" DOMAINS_TXT="/etc/dehydrated/domains.txt" # Keep the key, for DANE PRIVATE_KEY_RENEW="no" ```

adam closed this issue

2025-12-29 01:20:29 +01:00

adam commented

2025-12-29 01:20:30 +01:00

@bortzmeyer commented on GitHub (Oct 25, 2017):

I forgot to add: dehydrated version 0.3.1

@bortzmeyer commented on GitHub (Oct 25, 2017): I forgot to add: dehydrated version 0.3.1

adam commented

2025-12-29 01:20:30 +01:00

@bortzmeyer commented on GitHub (Oct 25, 2017):

Sorry for the false alarm, it was actually a wrong DANE configuration on my side (😊). I tested on the whole certificate (selector 0) not just on the key (selector 1).

I'll pay a beer to the dehydrated developer, as an apology.

@bortzmeyer commented on GitHub (Oct 25, 2017): Sorry for the false alarm, it was actually a wrong DANE configuration on my side (:blush:). I tested on the whole certificate (selector 0) not just on the key (selector 1). I'll pay a beer to the dehydrated developer, as an apology.

adam referenced this issue

2025-12-29 01:29:05 +01:00

[PR #261] [CLOSED] Retry invalid challenge responses, set number of retries to NUMBER #776

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#261