[BUG] Default self-signed certificate served when restarting even if a custom cert has been defined

[MB-Finski]

What happened?

On a fresh linux install of 1.5.10 restarting the bunkerweb service (or the underlying system) causes the default self-signed certificate to be served for a short while even if a custom certificate has been defined. This causes errors with the clients and serving data while being only partially configured during starting the services might be a security risk.

Possible/preferred solution: deny requests until fully configured after a restart.

How to reproduce?

• Fresh install of Bunkerweb 1.5.10 on Debian 12
• Define custom cert (from file)
• Continuously access a service and simultaneously restart the server
• Issue: Self-signed certificate is served for a short while right after restarting causing errors with clients

Configuration file(s) (yaml or .env)

NA

Relevant log output

NA

BunkerWeb version

1.5.10

What integration are you using?

Linux

Linux distribution (if applicable)

Debian 12

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi, thank you for opening this issue.
This is the default behavior of BunkerWeb when it doesn't have a config yet (when it restarts it uses a temporary config until the Scheduler send the new one).
When make changes changes only on setting (in the variables.env file), we recommend to use the following command instead:

systemctl reload bunkerweb

[MB-Finski]

I understand that it's the default behavior. The question was more of whether it should be the default behavior. I feel like it gives more attack surface (and fingerprinting ability) for a potential bad actor through having the possibility to interact with a partially configured proxy server. Restarts are required every now and then, after all...

As a somewhat related issue modsec configs are not updated (in fact the new configs are overwritten with the old configs) when a systemctl reload is used: is there a better way to update modsec configs besides systemctl restart?

[leberrem]

Hello,

I also have the same problem in the same version and deployment, when adding a new configuration with a custom certificate and reload bunkerweb. it appears with the default certificate. But if I empty the site cache in the “/var/cache/bunkerweb/customcert” folder and restart bunkerweb without modifying the configuration. It starts working correctly. Unfortunately, this creates an unavailability time that is not compatible with maintaining the site in operational condition in production.

can we force the scheduler to run and update configuration without a full restart?