From 8db46c786c7dbe7f65d049bd030033fd8f57d483 Mon Sep 17 00:00:00 2001 From: Martin Lablans Date: Tue, 26 May 2026 23:28:55 +0300 Subject: [PATCH] Fix CI/CD: Reuse existing proxy key when re-enrolling in dev PKI --- dev/pki/pki | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/dev/pki/pki b/dev/pki/pki index f19dabfd..d301291e 100755 --- a/dev/pki/pki +++ b/dev/pki/pki @@ -95,7 +95,15 @@ function request() { application=$1 cn=$2 ttl=$3 - openssl req -new -newkey rsa:2048 -nodes -keyout ${application}.priv.pem -out ${application}.csr -subj "/CN=${cn}" 2>/dev/null + # Beam only supports multiple certificates per proxy when they share one key. + # devsetup enrolls some proxies repeatedly to create duplicate certs, so reuse + # an existing key on re-enrollment and generate a fresh one only the first time; + # otherwise senders may encrypt to a key the proxy no longer holds. + if [ -s "${application}.priv.pem" ] && openssl pkey -in "${application}.priv.pem" -noout 2>/dev/null; then + openssl req -new -key "${application}.priv.pem" -out ${application}.csr -subj "/CN=${cn}" 2>/dev/null + else + openssl req -new -newkey rsa:2048 -nodes -keyout ${application}.priv.pem -out ${application}.csr -subj "/CN=${cn}" 2>/dev/null + fi data=$(jq -Rs '{common_name: "'$cn'", ttl: "'$ttl'", csr: .}' < ${application}.csr) echo "Creating Certificate for domain $cn" curl --header "X-Vault-Token: $VAULT_TOKEN" \