Reread TLS certificates in the backround

deekerman commented

2026-03-04 03:19:06 -05:00

Owner

Originally created by @laurentftech on GitHub (Dec 19, 2021).

Originally assigned to: @EugeneOne1 on GitHub.

Prerequisites

Please answer the following questions for yourself before submitting an issue. YOU MAY DELETE THE PREREQUISITES SECTION.

I am running the latest version
I checked the documentation and found no answer
I checked to make sure that this issue has not already been filed

Issue Details

I am using Caddyserver to renew automatically my TLS certificates. It seems they are renewed every 12 hours which very small overlapping in validity (I don't know if it is possible to change that). After 12 hours when I try to login the AGH front end, Safari warns me that the certificate has expired and that the connection is not safe. If I open the site anyway, the first page tells me that certificate has expired (see attached).
The renewed certificate is only taken into account when I go to the encryption setting page (where I have the path to the certificate and key).

Version of AdGuard Home server:
- v0.106.3
How did you install AdGuard Home:
- Docker
How did you setup DNS configuration:
- IoT
If it's a router or IoT, please write device model:
- NAS

Expected Behavior

Renewed TLS certificate to be taken into account in the background.

Actual Behavior

Renewed TLS certificate seems to be only taken into account when opening the encryption settings page.

Screenshots

Screenshot:

<!— drag and drop, upload or paste your screenshot to this area—>

Additional Information

Originally created by @laurentftech on GitHub (Dec 19, 2021). Originally assigned to: @EugeneOne1 on GitHub. ### Prerequisites Please answer the following questions for yourself before submitting an issue. **YOU MAY DELETE THE PREREQUISITES SECTION.** - [X] I am running the latest version - [X] I checked the documentation and found no answer - [X] I checked to make sure that this issue has not already been filed ### Issue Details I am using Caddyserver to renew automatically my TLS certificates. It seems they are renewed every 12 hours which very small overlapping in validity (I don't know if it is possible to change that). After 12 hours when I try to login the AGH front end, Safari warns me that the certificate has expired and that the connection is not safe. If I open the site anyway, the first page tells me that certificate has expired (see attached). The renewed certificate is only taken into account when I go to the encryption setting page (where I have the path to the certificate and key). * **Version of AdGuard Home server:** * v0.106.3 * **How did you install AdGuard Home:** * Docker * **How did you setup DNS configuration:** * IoT * **If it's a router or IoT, please write device model:** * NAS ### Expected Behavior Renewed TLS certificate to be taken into account in the background. ### Actual Behavior Renewed TLS certificate seems to be only taken into account when opening the encryption settings page. ### Screenshots  <details><summary>Screenshot:</summary> ![image](https://user-images.githubusercontent.com/44120190/146668658-d16e8ca6-8fec-4562-a5f5-35ae0b10974f.png)<!— drag and drop, upload or paste your screenshot to this area—> </details> ### Additional Information

deekerman

2026-03-04 03:19:06 -05:00

closed this issue
added the
feature request

P3: Medium
labels

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@ainar-g commented on GitHub (Dec 20, 2021):

The TLS certs are currently only updated when you either resave the encryption settings from the UI, or when you send SIGHUP to AGH.

@ameshkov, do we want some kind of background schedule to reload TLS certs in the future design / refactoring?

@ainar-g commented on GitHub (Dec 20, 2021): The TLS certs are currently only updated when you either resave the encryption settings from the UI, or when you send `SIGHUP` to AGH. @ameshkov, do we want some kind of background schedule to reload TLS certs in the future design / refactoring?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@ameshkov commented on GitHub (Dec 27, 2021):

@ainar-g yeah, it makes sense to me.

@ameshkov commented on GitHub (Dec 27, 2021): @ainar-g yeah, it makes sense to me.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@nuka-cola commented on GitHub (Apr 10, 2023):

I know that this is a slightly off-topic question, but if I am using Adguard-Home via Snap, where is the ideal place to store the let's encrypt certificates so that the snap container has access?

@nuka-cola commented on GitHub (Apr 10, 2023): I know that this is a slightly off-topic question, but if I am using Adguard-Home via Snap, where is the ideal place to store the let's encrypt certificates so that the snap container has access?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@ameshkov commented on GitHub (Apr 16, 2023):

@nuka-cola

Somewhere inside this directory:
/var/snap/adguard-home/current

For AGH running in a snap this would be the cwd directory.
I.e. you can specify the path to the certificate as ./cert.crt

@ameshkov commented on GitHub (Apr 16, 2023): @nuka-cola Somewhere inside this directory: `/var/snap/adguard-home/current` For AGH running in a snap this would be the cwd directory. I.e. you can specify the path to the certificate as `./cert.crt`

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (May 13, 2025):

This is become more important when Let's Encrypt's 6 day certificate become available.

https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/

@xlionjuan commented on GitHub (May 13, 2025): This is become more important when Let's Encrypt's 6 day certificate become available. https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Jul 6, 2025):

Let's Encrypt will ship IP certificates and 6 days of certificate latter this year.

https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate/

@xlionjuan commented on GitHub (Jul 6, 2025): Let's Encrypt will ship IP certificates and 6 days of certificate latter this year. https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate/

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Dec 3, 2025):

Let's Encrypt will ship IP certificates and 6 days of certificate soon, this is mandatory.

@xlionjuan commented on GitHub (Dec 3, 2025): Let's Encrypt will ship IP certificates and 6 days of certificate **soon**, this is mandatory.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@cigarzh commented on GitHub (Jan 14, 2026):

I’m having the same problem.

@cigarzh commented on GitHub (Jan 14, 2026): I’m having the same problem.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Feb 9, 2026):

@laurentftech, and anyone else who's interested: We've finally implemented background TLS certificate and key refreshing. This feature is currently available in the latest beta release (v0.108.0-b.82). Could you please try it out and provide some feedback?

@EugeneOne1 commented on GitHub (Feb 9, 2026): @laurentftech, and anyone else who's interested: We've finally implemented background TLS certificate and key refreshing. This feature is currently available in the latest beta release (`v0.108.0-b.82`). Could you please try it out and provide some feedback?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Feb 9, 2026):

@laurentftech, and anyone else who's interested: We've finally implemented background TLS certificate and key refreshing. This feature is currently available in the latest beta release (v0.108.0-b.82). Could you please try it out and provide some feedback?

will volumes mount as :ro affect filesystem watching? Or how the reload triggered?

@xlionjuan commented on GitHub (Feb 9, 2026): > [@laurentftech](https://github.com/laurentftech), and anyone else who's interested: We've finally implemented background TLS certificate and key refreshing. This feature is currently available in the latest beta release (`v0.108.0-b.82`). Could you please try it out and provide some feedback? will volumes mount as `:ro` affect filesystem watching? Or how the reload triggered?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Feb 10, 2026):

@xlionjuan, Docker installations will only detect changes to the file system if you mount the entire directory. However, the :ro modifier is fine.

@EugeneOne1 commented on GitHub (Feb 10, 2026): @xlionjuan, Docker installations will only detect changes to the file system if you mount the entire directory. However, the `:ro` modifier is fine.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Feb 10, 2026):

I'm mount as directory, not single file, but it seems not detected the file changes.

@xlionjuan commented on GitHub (Feb 10, 2026): I'm mount as directory, not single file, but it seems not detected the file changes.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Feb 10, 2026):

I'm mount as directory, not single file, but it seems not detected the file changes.

@xlionjuan commented on GitHub (Feb 10, 2026): I'm mount as directory, not single file, but it seems not detected the file changes.

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@xlionjuan commented on GitHub (Feb 10, 2026):

I'm creating container with read_only: true will the detect mechanism need to have the ability to write somewhere?

@xlionjuan commented on GitHub (Feb 10, 2026): I'm creating container with `read_only: true` will the detect mechanism need to have the ability to write somewhere?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Feb 10, 2026):

@xlionjuan, as far as I know, the detection mechanism shouldn't write anything. Unfortunately, we'll need more details about your setup. Could you please file a separate issue with additional information about the environment in which you're running AdGuard Home?

@EugeneOne1 commented on GitHub (Feb 10, 2026): @xlionjuan, as far as I know, the detection mechanism shouldn't write anything. Unfortunately, we'll need more details about your setup. Could you please file a separate issue with additional information about the environment in which you're running AdGuard Home?

deekerman commented

2026-03-04 03:19:25 -05:00

Author

Owner

@EugeneOne1 commented on GitHub (Feb 19, 2026):

This feature is available in version v0.107.72. Please file separate issues for any problems. We'll close this issue for now.

@EugeneOne1 commented on GitHub (Feb 19, 2026): This feature is available in version `v0.107.72`. Please file separate issues for any problems. We'll close this issue for now.

Rows
Columns

Reread TLS certificates in the backround #3270

Prerequisites

Issue Details

Expected Behavior

Actual Behavior

Screenshots

Additional Information