Description of feature
Follow-up to #525, which makes dokku_certs probe the installed certificate by reading its PEM back with certs:show and comparing it against the desired one. That works and is actionable today, but it means transferring the whole certificate off the server on every plan, purely to decide whether anything needs to change.
dokku/dokku#8992 asks for a fingerprint field on certs:report - the SHA-256 digest of the DER encoding, alongside the --ssl-expires-at / --ssl-issuer / --ssl-subject fields the report already carries. Once that exists, the probe becomes a single report read compared against a digest computed locally from the desired certificate, with no certificate material crossing the wire at plan time.
That is strictly cheaper and strictly less sensitive than what #525 will do, so this is a refinement rather than a replacement: #525 should land first and not wait on upstream.
Two details for whoever picks this up. The digest has to be computed over the DER encoding rather than the PEM text, or the comparison inherits exactly the whitespace and trailing-newline sensitivity that #525 has to normalise around. And the global certificate needs the same treatment through global-cert:report, assuming the upstream field lands in both places - worth confirming rather than assuming, since the two plugins are separate.
Blocked on dokku/dokku#8992, and on #525 for the probe itself.
Description of feature
Follow-up to #525, which makes
dokku_certsprobe the installed certificate by reading its PEM back withcerts:showand comparing it against the desired one. That works and is actionable today, but it means transferring the whole certificate off the server on everyplan, purely to decide whether anything needs to change.dokku/dokku#8992 asks for a fingerprint field on
certs:report- the SHA-256 digest of the DER encoding, alongside the--ssl-expires-at/--ssl-issuer/--ssl-subjectfields the report already carries. Once that exists, the probe becomes a single report read compared against a digest computed locally from the desired certificate, with no certificate material crossing the wire at plan time.That is strictly cheaper and strictly less sensitive than what #525 will do, so this is a refinement rather than a replacement: #525 should land first and not wait on upstream.
Two details for whoever picks this up. The digest has to be computed over the DER encoding rather than the PEM text, or the comparison inherits exactly the whitespace and trailing-newline sensitivity that #525 has to normalise around. And the global certificate needs the same treatment through
global-cert:report, assuming the upstream field lands in both places - worth confirming rather than assuming, since the two plugins are separate.Blocked on dokku/dokku#8992, and on #525 for the probe itself.