Forwarded to devs SSLIt configuration files not removed in some cases when a customer and/or domains of that customer are removed

[Bitpalast]

Username:

TITLE

SSLIt configuration files not removed in some cases when a customer and/or domains of that customer are removed

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

18.0.48 (but also in earlier versions)
CentOS 7.9

PROBLEM DESCRIPTION

When a domain, a subscription or a customer is removed, in some cases the SSLIt certificate folders for the affected domain(s) are not removed from /usr/local/psa/var/modules/sslit/etc/live/<domain>.

Also, SSL renewal messages on such a domain are not removed from the SQLite database, e.g.
# sqlite3 /usr/local/psa/var/modules/sslit/sslit.sqlite3
then run
> select id,createdDate,state,params from Notification where params like '%<domain>%' order by id desc limit 10;
will result in renewal messages (or failure messages) for that domain.

STEPS TO REPRODUCE

Difficult to reproduce, because it does not happen always. I think it happens more frequently when a certificate could not be renewed because the domain is no longer registered, but it does not seem to be consistently that case.

In general: Have a domain with SSL, then remove that domain from Plesk.

ACTUAL RESULT

Sometimes, not always, the /usr/local/psa/var/modules/sslit/etc/live/<domain> is not removed.

Messages in the SQLite message queue are also not removed.

EXPECTED RESULT

Always remove /usr/local/psa/var/modules/sslit/etc/live/<domain>.
Always remove all messages from the Notification table of sslit/sslit.sqlite3 that affect the deleted domain.

ANY ADDITIONAL INFORMATION

(DID NOT ANSWER QUESTION)

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[IgorG]

Thank you, Peter.
Looks like there are already existing bugs:

• SSL It! - EXTSSLIT-1921 ("Certificates from removed domains still exist in var/etc/live directory"),
• Let's Encrypt - EXTLETSENC-643 ("Certificates from removed domains still exist in var/etc/live directory").

 

[Bitpalast]

Thanks, hopefully I wasn't the one who reported that twice before ... It came to my attention (again) because notifications are being sent for the non-existent domains.