Add SSL certificate checking and regeneration scripts

[brainstemu]

Add SSL certificate check and regeneration

What?

Adds automated SSL certificate checking and regeneration support for Hubs deployments.

This pull request includes:

• ssl_script/check-cert.js for checking certificate expiration status
• ssl_script/regen-ssl.js for regenerating SSL certificates when renewal is needed
• package.json updates to expose the new SSL maintenance commands
• Supporting SSL script changes required for the regeneration flow

This implementation uses the existing Hubs environment variables and deployment configuration rather than hard-coded deployment-specific values.

Why?

Hubs deployments rely on valid TLS certificates for the main Hubs domain and its related subdomains.

Without an automated check and renewal workflow, certificate expiration requires manual monitoring and intervention. If certificates expire, users can encounter browser security warnings or lose access to the deployment entirely.

This change makes SSL maintenance easier and more reliable by providing scripts that can:

• Check the current certificate expiration status
• Determine when certificate regeneration is needed
• Regenerate the required certificates
• Update the Kubernetes TLS configuration as part of the existing Hubs SSL workflow

This change assumes the www-redirect functionality has already been applied, since the SSL regeneration flow includes certificate handling for the www.$HUB_DOMAIN hostname.

Examples

Check the current certificate:

npm run check-cert

or directly:

node ssl_script/check-cert.js

Regenerate SSL certificates:

npm run regen-ssl

or directly:

node ssl_script/regen-ssl.js

The certificate check can be used to determine whether the certificate is approaching expiration before running the regeneration process.

How to test

1. Start with a Hubs deployment that includes the www-redirect functionality.

2. Configure the normal Hubs environment variables required by the existing SSL setup.

3. Confirm access to the Kubernetes cluster:

   kubectl get pods -n "$Namespace"

4. Run the certificate check:

   npm run check-cert

5. Confirm that the script successfully reads the current certificate and reports its expiration status.

6. Run the SSL regeneration process:

   npm run regen-ssl

7. Confirm that the required Kubernetes TLS secrets are created or updated successfully.

8. Confirm that the Hubs workloads remain healthy:

   kubectl get pods -n "$Namespace"

9. Verify the TLS secrets:

   kubectl get secrets -n "$Namespace"

10. Verify HTTPS access to the configured Hubs domain:

    curl -I "https://$HUB_DOMAIN"

11. Verify HTTPS access to the www hostname:

    curl -I "https://www.$HUB_DOMAIN"

12. Confirm that the www hostname has a valid certificate and redirects to the configured Hubs domain as expected.

Documentation of functionality

The functionality is implemented directly in:

• ssl_script/check-cert.js
• ssl_script/regen-ssl.js
• package.json

No separate documentation pull request is included.

The scripts and package commands provide the operational entry points for checking and regenerating certificates.

Limitations

This implementation assumes:

• The Hubs deployment is already running
• The www-redirect functionality is present
• DNS is correctly configured for the Hubs domain and required subdomains
• The machine running the scripts has access to the Kubernetes cluster
• The required Hubs environment variables are configured
• The existing Hubs certificate-generation dependencies are available

This pull request does not introduce a Kubernetes CronJob or other server-side scheduler for automatically running the certificate check on a recurring schedule.

Alternative implementations considered

Manual certificate renewal was considered, but it requires an administrator to track certificate expiration and manually perform the regeneration process.

A Kubernetes-native scheduled renewal process was also considered. This pull request keeps the initial implementation focused on reusable certificate checking and regeneration scripts so they can be tested independently and integrated into a scheduled process separately if desired.

The certificate check and regeneration logic are kept as separate scripts so the certificate can be inspected without unnecessarily triggering a renewal.

Open questions

None.

Additional details or related context

This pull request is dependent on the www-redirect work because the SSL regeneration flow includes certificate handling for:

www.$HUB_DOMAIN

For review, this PR should use:

base: www-redirect
compare: ssl-regen

until the www-redirect pull request is merged.

After the www-redirect pull request is merged, this pull request can be retargeted to the repository's main branch.

The implementation uses environment variables and does not intentionally include deployment-specific domains, credentials, certificates, or other sensitive values.

[github-actions]

Thank you for the pull request.

ROADMAP STATUS: This pull request isn't currently on any roadmap. Updates will be conveyed here as its place on/off a roadmap changes.

You can view the roadmaps here: Roadmaps Google Drive folder.

For more information on how the roadmaps work, see our roadmaps policy on GitHub.