pfSense » pfSense Packages

I have two hosts using HA syncing to push the certificate store from host1 (primary) to host2 (backup). ACME renewal runs only on host1, which is configured to use XMLRPC to restart the webconfigurator on host2 as documented.

Recently we had an expired cert issue appear on host2. Restarting the webconfigurator via SSH fixed this immediately, as it appeared the certificates had transferred properly. In testing, I did a forced renewal and duplicated this result. pfSense cert manager on host2 showed the new certificate was in place, and the logs showed the XMLRPC request to restart had been received and acted on. Running "reloadcmd.sh" a second time resolved this and the new certificate was in use by host2.

My speculation here is that the restart request is hitting host2 before the XMLRPC sync of the certificate store is complete. Is it possible to check sync status before requesting restart? Should there be an option to delay the restart request by a few seconds? Is there some neat solution other than just having a cron job to restart the webconfigurator once a week or so?