Impacts of Changing out MySQL Databases

[TheSecMaven]

we currently use a mysql database and are changing DBs so we can get a database which replicates to an offsite DR location. What is the impact if we don't do a restore from the current DB? We would lose the number of certs we already issued, and the ability to do passive revocation. Anything else significant that comes to mind?

[tashian]

I believe ACME state is stored in the db—namely, open orders.

[TheSecMaven]

got it. so if someone was in progress of getting an ACME cert, then it would fail? or is there something else to that?

[tashian]

Yes, definitely those open orders would fail because the original request would not be found by the CA.
I'm not sure what else would be affected by database loss.

[dopey]

Beside in progress ACME orders, you'd lose all used_tokens and all revoked certificates. Which likely isn't a big deal. Tokens have a default time limit of 5mins and certs are defaulted to lifetime of a day.

[jodygilbert]

I tried doing this switch. I'm using traefik for the acme clients and they all failed to renew their certs. The error reported by step-ca was "Account does not exist".
It wasn't the end of the world for me, I've only got a handful of acme clients so I deleted their existing certs.

Not sure if this was expected though.