4 ms·

Supplying an email address to Let's Encrypt is optional.

• tialaramex 9y ago
  ... but if you don't supply one of course Let's Encrypt won't notify you about anything. So if you aren't paying attention you may get blind-sided by any future change, particularly if your use case is weird e.g. you can only pass http-01 by HTTP 301 redirecting to a machine with a completely different hostname, works today, could get outlawed as dangerous one day and they'd have the records to show you're going to be affected, but no way to automatically warn you.
  • mholt 9y ago
    I recommend always monitoring server logs as a last line of defense (or first, honestly) for these kinds of things.
    • Ajedi32 9y ago
      Do Apache's server logs notify you if your cert is about to expire, but hasn't yet?
      • mholt 9y ago
        I doubt it does in general, but mod_md does have a pretty chatty log if you enable it. Haven't tested this specifically, but I assume it prints something around renewal time.
      • majewsky 9y ago
        Expiration dates on your TLS certs is usually something that you want to monitor and alert on anyway. I'd actually build the monitoring separately from the renewal process, just in case that the renewal process doesn't notice that it fails.
  • DonbunEf7 9y ago
    As a good first step, it's easy to configure the Prometheus blackbox exporter (or your TLS-supporting blackbox scraper of choice) to report the TLS cert expiry date; I have an alert which pages me if a TLS cert will expire in a week or sooner based on this.