4 ms·

This is also why you don't wait until the last day before renewing. (But no-one does that, right?)

tscs37 9y ago
>But no-one does that, right? Sadly, reality is not that nice and I can already feel a disturbance in the force in form of "Why Lets Encrypt is bad and you should by 1 year certs" blog posts all over the place.
IgorPartola 9y ago
If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs. If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.
- StevePerkins 9y ago
  Wish someone would write one of those automated tools for Google App Engine-hosted apps. That renewal process is exactly like regex. Once every three months I need it, and have to spend an hour re-learning it from scratch.
  - Ajedi32 9y ago
    Apparently they're working on that: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034 (For some reason it seems you need to sign in to view this bug; not sure why.)
- Bartweiss 9y ago
  > So right now the issue should only be with new domains getting certs. Certainly should have been, but it looks like a lot of libraries are choking on the outage even if the old cert is 100% valid.
  - IgorPartola 9y ago
    I use https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated which is a bash script for doing this. It doesn't choke because it's just a cron job. I also use dokku's LE plugin which is... also a shell script corn job. Maybe that's the way to do this. I know Caddy is an exception case for this.
alixaxel 9y ago
If you have your nginx HTTP vhost configured for serving {{ domain }}/.well-known/acme-challenge/ from /var/www/{{ domain }}, then getting a new cert and having it automatically renewed it's as simple as running: certbot certonly --webroot --webroot-path /var/www/{{ domain }} --agree-tos -m {{ email }} --domain {{ domain }} --renew-hook "service nginx reload" If certbot was installed with PIP, a CRON job will be automatically created and it will run with whatever arguments the certificate was first obtained with (--renew-hook is obviously important).
- mort96 9y ago
  That assumes the only sites you want to use SSL with is sites with a web root. Many sites use python's flask or node.js or similar, where you instead have an http server running on a high port, then proxy requests to certain domains to those ports. Such a script won't work with a setup like that.

>But no-one does that, right? Sadly, reality is not that nice and I can already feel a disturbance in the force in form of "Why Lets Encrypt is bad and you should by 1 year certs" blog posts all over the place.

IgorPartola 9y ago

If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs. If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.

StevePerkins 9y ago
Wish someone would write one of those automated tools for Google App Engine-hosted apps. That renewal process is exactly like regex. Once every three months I need it, and have to spend an hour re-learning it from scratch.
- Ajedi32 9y ago
  Apparently they're working on that: https://issuetracker.google.com/issues/35900034 https://issuetracker.google.com/issues/35900034 (For some reason it seems you need to sign in to view this bug; not sure why.)
Bartweiss 9y ago
> So right now the issue should only be with new domains getting certs. Certainly should have been, but it looks like a lot of libraries are choking on the outage even if the old cert is 100% valid.
- IgorPartola 9y ago
  I use https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated which is a bash script for doing this. It doesn't choke because it's just a cron job. I also use dokku's LE plugin which is... also a shell script corn job. Maybe that's the way to do this. I know Caddy is an exception case for this.

alixaxel 9y ago

If you have your nginx HTTP vhost configured for serving {{ domain }}/.well-known/acme-challenge/ from /var/www/{{ domain }}, then getting a new cert and having it automatically renewed it's as simple as running: certbot certonly --webroot --webroot-path /var/www/{{ domain }} --agree-tos -m {{ email }} --domain {{ domain }} --renew-hook "service nginx reload" If certbot was installed with PIP, a CRON job will be automatically created and it will run with whatever arguments the certificate was first obtained with (--renew-hook is obviously important).

mort96 9y ago
That assumes the only sites you want to use SSL with is sites with a web root. Many sites use python's flask or node.js or similar, where you instead have an http server running on a high port, then proxy requests to certain domains to those ports. Such a script won't work with a setup like that.