argo-cd: argocd-server services randomly new / old / expired cerificate from secret argocd-server-tls

Checklist:

Describe the bug

Since version 2.4.3 I noticed argocd-server is sometimes serving older / expired certs that should not be served any more. We first noticed this after the upgrade from 2.2.5 to 2.4.11. The problem exists in 2.4.12 too.

To Reproduce Use this https://github.com/vx-github/vx-argocd-cert-bug to easily reproduce the issue locally in a kind cluster.

Expected behavior

Expected behavior would be that argcd-server only serves / uses the cert in argocd-server-tls secret if it exists and doesn’t serves / uses certs it was not supposed to (old / expired ones).

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Reactions: 3
  • Comments: 15 (6 by maintainers)

Commits related to this issue

Most upvoted comments

I can confirm this is happening to me as well, in fact argo seems to cycle between certs. However it only happens if the argocd-server-tls secret doesn’t exist.

$ while true ; do echo | openssl s_client -showcerts -servername example.com -connect example.com:443 2>/dev/null | grep issuer ; done                                                                           issuer=C = US, O = Let's Encrypt, CN = R3                                                                                       issuer=C = US, O = Let's Encrypt, CN = R3                                                                                       issuer=C = US, O = Let's Encrypt, CN = R3                                                                                       issuer=C = US, O = Let's Encrypt, CN = R3                                                                                       issuer=O = cert-manager                                                                                                         issuer=O = cert-manager                                                                                                         issuer=O = cert-manager                                                                                                         issuer=O = cert-manager                                                                                                         issuer=O = cert-manager                                                                                                         issuer=O = Argo CD                                                                                                              issuer=O = Argo CD

Killing the pod works as a workaround.

+5
cwiggs on Jan 26, 2023
Read more comments on GitHub
← argo-cd: ArgoCD Server - main.js returns 404 Error
argo-cd: ArgoCD stuck on "Refresh" →