Search code examples
amp-html

AMP Cache Public RSA Key invalidation problem

Since our initial configuration according to https://developers.google.com/amp/cache/update-cache , we were successfully using the /update-cache/c/s/ endpoint for cache purge. Until yesterday, when we accidentally removed the public/private keys that we were using..!

So.. obviously the problem is that the AMP Cached Public RSA key now differ from our current(new) public rsa key.

(I am using example.com below for privacy reasons. Sorry about that)

We generated a new pair but the cached RSA Key does not revalidate even though we tried to revalidate it via

curl -XGET https://www-example-com.cdn.ampproject.org/r/s/www.example.com/.well-known/amphtml/apikey.pub -v

Detailed info

Our new public key is:

  1. served by webserver in text/plain format
  2. available at https://www.example.com/.well-known/amphtml/apikey.pub
  3. configured to be BYPASSED by cdn & server cache (Cloudflare & nginx).
  4. allowed (via robots.txt) to be crawled/indexed by all bots Allow: /.well-known/amphtml/apikey.pub

FULL robots.txt:

User-agent: * 
Disallow: /wp-admin/
Disallow: /trackback/
Disallow: /xmlrpc.php
Disallow: /feed/
Disallow: /wp-login.php
Disallow: /?s=
Disallow: /search/
Allow: /.well-known/amphtml/apikey.pub

User-agent: Googlebot
Disallow: /*?*smid=
Disallow: /*?*partner=
Disallow: /*?*utm_source=

URL Formats:

  1. AMP Cache Check:
https://www-example-com.cdn.ampproject.org/c/s/www.example.com/article-slug/amp/
  1. AMP RSA Key Revalidation:
https://www-example-com.cdn.ampproject.org/r/s/www.example.com/.well-known/amphtml/apikey.pub
  1. AMP Cache Purge/Update: (Auto generated by AMP Cache Update URL Generator https://github.com/enteresanlikk/amp-cache-update)
https://www-example-com.cdn.ampproject.org/update-cache/c/s/www.example.com/article-slug/amp/?amp_action=flush&amp_ts=<timestamp>&amp_url_signature=<signature>

Since the two RSA keys are different, we are now getting a 403 URL signature verification error.

24 hours have passed since the key change.. Is there any way that we can force the old cached RSA key to invalidate/re-cache ?

Or are am i doing anything wrong here?

Thanks!

Solution

  • Fixed. It was not an issue after all... Just needed to wait a little longer. RSA Key updated and afterwards AMP Cache cleared as normal!

    Everything i described is correct. Leaving it as a guide for others.

    Thanks