v0.28.1

src/admin/certificates.rs

@@ -40,6 +40,16 @@ async fn certificate_deploy(
                 ),
             ));
         }
+        if crate::tls::certificate_files_are_external(&selected.cert_file, &selected.key_file)
+            .map_err(|error| ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("{error:#}")))?
+        {
+            return Err(ApiError(
+                StatusCode::CONFLICT,
+                format!(
+                    "certificate {certificate_id} uses external file paths; renew those files in place and call the certificate reload endpoint instead of deploy"
+                ),
+            ));
+        }
         Some((selected.cert_file.clone(), selected.key_file.clone()))
     } else {
         None