4 ms·

> One of my favourite functions (certinfo) reports back on when you're LetsEncrypt SSL certificate is going to expire. How handy is that? I can't help but feel

by jbob2000 9y ago

> One of my favourite functions (certinfo) reports back on when you're LetsEncrypt SSL certificate is going to expire. How handy is that? I can't help but feel that this is over-engineering to its highest degree. What is a calendar for? Create an event in Google Calendar or whatever and have it notify you a few days in advance. Completely non-technical solution that everybody already knows how to do.

perlgeek 9y ago
Not at all. Let's say you manage 100 machines, possibly for different domains, and each generates their own certs. Now you probably want monitoring that alerts you when the certificate is about to expire in the next 20 days (you can renew them 30 days before they expire, without running into rate limit shenanigans). With 100 servers, you'll have on average about two calendar entries per day, most of which are no-ops, because the certificate renewal worked fine.
- lkerrekfjk 9y ago
  You certainly do not need "infinite scaling" to do that. Just a queue of workers running on a dumb server or even just a crontab... Yes it is the very definition of over engineering.
  - perlgeek 9y ago
    No, you don't need "infinite scaling" for just that. But if you have a FaaS-Setup anyway, you might as well reuse it for such relatively simple (but still useful) tasks.
  - icebraining 9y ago
    A full Linux kernel and cron daemon for that? You could run it on an ESP32!
- stephenr 9y ago
  You know that LE will email you if a cert isn't automatically renewed, right?
  - detaro 9y ago
    Anecdotally, the case of "certificate renewed, but setup not properly configured to reload all services afterwards" happens quite a bit.
    - inopinatus 9y ago
      See also: updating vulnerable library packages but not restarting dependent daemons.
emilburzo 9y ago
Wasn't the whole point of LetsEncrypt's short certificate expiration period to promote setting up automatic renewal? So no more calendar reminders every year, having to look up what's the correct order to concatenate comodo's chain and so on.

perlgeek 9y ago

Not at all. Let's say you manage 100 machines, possibly for different domains, and each generates their own certs. Now you probably want monitoring that alerts you when the certificate is about to expire in the next 20 days (you can renew them 30 days before they expire, without running into rate limit shenanigans). With 100 servers, you'll have on average about two calendar entries per day, most of which are no-ops, because the certificate renewal worked fine.

lkerrekfjk 9y ago
You certainly do not need "infinite scaling" to do that. Just a queue of workers running on a dumb server or even just a crontab... Yes it is the very definition of over engineering.
- perlgeek 9y ago
  No, you don't need "infinite scaling" for just that. But if you have a FaaS-Setup anyway, you might as well reuse it for such relatively simple (but still useful) tasks.
- icebraining 9y ago
  A full Linux kernel and cron daemon for that? You could run it on an ESP32!
stephenr 9y ago
You know that LE will email you if a cert isn't automatically renewed, right?
- detaro 9y ago
  Anecdotally, the case of "certificate renewed, but setup not properly configured to reload all services afterwards" happens quite a bit.
  - inopinatus 9y ago
    See also: updating vulnerable library packages but not restarting dependent daemons.

emilburzo 9y ago

Wasn't the whole point of LetsEncrypt's short certificate expiration period to promote setting up automatic renewal? So no more calendar reminders every year, having to look up what's the correct order to concatenate comodo's chain and so on.