4 ms·

Due to the lack of automated renewal procedures, I've seen many more small websites die for a day or so once a year with "traditional" certificates (when people

Due to the lack of automated renewal procedures, I've seen many more small websites die for a day or so once a year with "traditional" certificates (when people forget to manually renew) than those with certificates maintained via letsencrypt. The actual solution to this should be for any of those providers to provide the ACME certificate management protocol, and then if letsencrypt fails, I can point certbot at it.

wastedhours 9y ago
I was always on that end - in a distant-ago job I'd somehow fallen into a position of looking after a server box for our subdomain that was under someone's desk. Every year I'd preempt it and email our procurement and IT teams asking for a renewal months in advance (knowing the red tape means I'd get it JIT). And, every year it wouldn't be renewed or bought until the day after expiry when I had enough complaints from people to light a fire under someone's arse. The whole cert-package back and forth was a nightmare, am glad LE exists with auto renewals (or even manually pushing a renewal with one line is easier than the old).
Fnoord 9y ago
There's always going to be stuff which is automatically renewed while you don't want to, or stuff you need to manually renew when you have to. I have a wonderful suggestion for anyone who wants to combat this problem: put the end date in your agenda! If you're a busy person put multiple notifications about it, or learn to look in advance in your agenda.
- vertex-four 9y ago
  I don't think there's any situation I've seen where I don't want my certificates to be renewed. As a sysadmin, the more repetitive tasks I can automate, the better.
  - Fnoord 9y ago
    You must've seen automated subscriptions which you did not want to renew? My comment was more a general statement to combat a type of procrastination (a deadline which must be met slightly before its date), specifically with the mechanic of both automated and manual subscriptions. Calendar reminders work wonderful with _both_. I can also think of various scenarios where you don't want certificates to be renewed. Or well, maybe you don't but the users would. Like for example when your server no longer works, or got confiscated. A low timeout aids in lowering the amount of those certificates.
    - vertex-four 9y ago
      Automated payments are a different matter from automated infrastructure that's already been paid for. I have automated tickets created when I need to do things that I haven't automated yet, but, I still want to automate as much as possible. I have not run into the problems that you're suggesting I should've. If a server no longer works or was confiscated, why would I still have DNS pointing at it? And does it really matter if I have some servers renewing certificates unnecessarily anyway?

wastedhours 9y ago

I was always on that end - in a distant-ago job I'd somehow fallen into a position of looking after a server box for our subdomain that was under someone's desk. Every year I'd preempt it and email our procurement and IT teams asking for a renewal months in advance (knowing the red tape means I'd get it JIT). And, every year it wouldn't be renewed or bought until the day after expiry when I had enough complaints from people to light a fire under someone's arse. The whole cert-package back and forth was a nightmare, am glad LE exists with auto renewals (or even manually pushing a renewal with one line is easier than the old).

Fnoord 9y ago

There's always going to be stuff which is automatically renewed while you don't want to, or stuff you need to manually renew when you have to. I have a wonderful suggestion for anyone who wants to combat this problem: put the end date in your agenda! If you're a busy person put multiple notifications about it, or learn to look in advance in your agenda.

vertex-four 9y ago
I don't think there's any situation I've seen where I don't want my certificates to be renewed. As a sysadmin, the more repetitive tasks I can automate, the better.
- Fnoord 9y ago
  You must've seen automated subscriptions which you did not want to renew? My comment was more a general statement to combat a type of procrastination (a deadline which must be met slightly before its date), specifically with the mechanic of both automated and manual subscriptions. Calendar reminders work wonderful with _both_. I can also think of various scenarios where you don't want certificates to be renewed. Or well, maybe you don't but the users would. Like for example when your server no longer works, or got confiscated. A low timeout aids in lowering the amount of those certificates.
  - vertex-four 9y ago
    Automated payments are a different matter from automated infrastructure that's already been paid for. I have automated tickets created when I need to do things that I haven't automated yet, but, I still want to automate as much as possible. I have not run into the problems that you're suggesting I should've. If a server no longer works or was confiscated, why would I still have DNS pointing at it? And does it really matter if I have some servers renewing certificates unnecessarily anyway?