Commits
Tarun Sukhani authored c55ffc7d7ba
feat: enable-https auto-regenerates expired/corrupted certs + adds --regenerate (release 1.12.20)
PF-68 follow-up: when conf/host.cert and conf/host.key both exist,
enable-https previously reused them blindly. If the cert had expired
or the file was corrupted, the framework would fail at TLS handshake
or boot with a confusing error and the user had no in-band recovery —
they had to manually delete the files and re-run.
Two complementary fixes:
1. Auto-regeneration on expiry / corruption (default behavior).
When openssl is on PATH, _check_cert_validity() runs
`openssl x509 -noout -in cert` to detect parse failure
('corrupted') and `openssl x509 -checkend 0` to detect expiry
('expired'). Either reason triggers transparent regeneration with
a clear status message naming the path:
~ Existing cert at conf/host.cert has expired — regenerating.
~ Existing cert at conf/host.cert is unreadable — regenerating.
Localhost dev certs aren't worth the manual-recovery dance, and
the message tells the user what just happened. When openssl isn't
on PATH the check returns 'unknown' and we fall back to blind
reuse (same as pre-fix behavior).
2. --regenerate flag (explicit). Operators who want a fresh cert for
non-expiry reasons (rotated keys, switched mkcert↔openssl, changed
local hostname) pass --regenerate and skip the validity check
entirely:
$ play enable-https --regenerate
~ --regenerate: regenerating PEM cert+key (existing files will be replaced).
Note: the bare --force flag is reserved by the top-level play CLI
(intercepted at /opt/play1/play:101-104 for the ignoreMissing path
before commands see args), so we use --regenerate instead.
Generation logic is unchanged: mkcert if on PATH (preferred — the
local CA install makes the cert trusted by the system store, which
Chrome's QUIC stack needs for HTTP/3), openssl req -x509 -nodes as
fallback.
End-to-end verified against four scenarios on a fresh app:
A. Valid cert, re-run → reuse, mtime unchanged ✓
B. Valid cert, --regenerate → regenerate, mtime updated ✓
C. Backdated/expired cert → auto-regenerate, "has expired" msg ✓
D. Corrupted (non-PEM) cert → auto-regenerate, "unreadable" msg ✓
cmd-enable-https.txt updated: synopsis includes [--regenerate],
description block adds Auto-regeneration and Forced regeneration
sections, plus a note about why we use --regenerate not --force.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>