4 ms·

A small outage should not matter at all in case of renewal, because clients are configured to renew days or weeks before cert expiration.

GetOutOfBed 7y ago
Yeah... my own setup for a hobby project of mine renew 30 days in advance but I don't think the way it is set up will try again tomorrow if it fails today.
- Filligree 7y ago
  I've got a systemd timer that tries to renew it once per day. It just aborts early if the existing cert has more than 45 days left in it.
  - copperx 7y ago
    Isn't that placing a lot of load on a free service?
    - shawnz 7y ago
      With certbot, the check to see if certificates are close to expiry is done offline. So the service is only hit if a renewal is needed. The developers of certbot actually recommend that you schedule the cron twice a day. EDIT: Actually I'm wrong. It also checks if the certificate was revoked via OCSP. However I can't imagine that it consumes much resources.
      - schoen 7y ago
        They're also different resources, and cacheable ones.
    - ceejayoz 7y ago
      That free service has rate limits, which are presumably set to a sustainable level for them.
    - Filligree 7y ago
      "Aborts early", in this case meaning before any network calls are made.
  - buboard 7y ago
    i also have a daily cron. One of the renewals somehow repeatedly reissued the cert for 5 consecutive days without me noticing. For some reason the certificate was also nowhere to be found, and letsencrypt woulnd't let me manually renew the certificate because it had exceeded the limit of 5 issuances/month (or something of that sort). Thankfully the limitation is only for the exact same cert, so you can issue a new one for a slightly different set of domains without waiting for the period to pass.
- shawnz 7y ago
  The default configuration for certbot in most distros is to attempt renewal twice a day
- yyyk 7y ago
  dehydrated is easy to set up this way, and has barely any dependencies.
delfinom 7y ago
Somewhere out there is a person writing am angry blog post about how unreliable letsencrypt is because they set the renewal date to last minute
- sebazzz 7y ago
  Good chance one of the classic CAs will use this outage against Let's Encrypt though. Some classic CAs have been spreading a lot of FUD about Let's Encrypt.
  - GuyPostington 7y ago
    Probably. What matters is the community response to the outage though. From what I saw there's been a ton of love for the team working through an entire Sunday.
hlieberman 7y ago
And this is the reason why Debian (and its derivs) ship a cron and systemd timer for you with certbot. You shouldn't have to think about or worry about this stuff. Certbot handles it for you.
- copperx 7y ago
  For some reason my cron task always fails to renew, and I have to manually renew at the last minute, when I notice the certificate has expired. This is for a personal site, so it doesn't matter. I tried many things, and can verify the cron task renews when I test it, but months later it always fails.
  - laggyluke 7y ago
    Is your cron, by any chance, configured to run on every first day of month at midnight?
  - hlieberman 7y ago
    Is this on Debian? There should be a log file created in /var/log/letsencrypt on each attempt; if you could send me one at my username @debian.org, or ping me on Freenode IRC, I may be able to help you debug. I'm guessing it's because your renew.conf's trying to use the "simple" authentication method which won't work if you've got a webserver running.
  - mrighele 7y ago
    Not a solution to your problem, but if you supply an email when creating a certificate, you will receive a notification plenty in advance (three or four weeks, I think)
  - schoen 7y ago
    You're welcome to join us on https://community.letsencrypt.org/ https://community.letsencrypt.org/ and we can help you debug this.
  - johnchristopher 7y ago
    I receive a mail when certs are soon expired. I also set up traefik with auto renewal so it's a setup and forget thing now.
whatthesmack 7y ago
True, but still quite impactful for initial issuance being provided live to end users of things like Squarespace, Zendesk, Pardot, etc.
Thorrez 7y ago
The Caddy server can be configured to request a certificate while the user makes a request. That means things hosted in that manner might have downtime from this.

GetOutOfBed 7y ago

Yeah... my own setup for a hobby project of mine renew 30 days in advance but I don't think the way it is set up will try again tomorrow if it fails today.

Filligree 7y ago
I've got a systemd timer that tries to renew it once per day. It just aborts early if the existing cert has more than 45 days left in it.
- copperx 7y ago
  Isn't that placing a lot of load on a free service?
  - shawnz 7y ago
    With certbot, the check to see if certificates are close to expiry is done offline. So the service is only hit if a renewal is needed. The developers of certbot actually recommend that you schedule the cron twice a day. EDIT: Actually I'm wrong. It also checks if the certificate was revoked via OCSP. However I can't imagine that it consumes much resources.
    - schoen 7y ago
      They're also different resources, and cacheable ones.
  - ceejayoz 7y ago
    That free service has rate limits, which are presumably set to a sustainable level for them.
  - Filligree 7y ago
    "Aborts early", in this case meaning before any network calls are made.
- buboard 7y ago
  i also have a daily cron. One of the renewals somehow repeatedly reissued the cert for 5 consecutive days without me noticing. For some reason the certificate was also nowhere to be found, and letsencrypt woulnd't let me manually renew the certificate because it had exceeded the limit of 5 issuances/month (or something of that sort). Thankfully the limitation is only for the exact same cert, so you can issue a new one for a slightly different set of domains without waiting for the period to pass.
shawnz 7y ago
The default configuration for certbot in most distros is to attempt renewal twice a day
yyyk 7y ago
dehydrated is easy to set up this way, and has barely any dependencies.

delfinom 7y ago

Somewhere out there is a person writing am angry blog post about how unreliable letsencrypt is because they set the renewal date to last minute

sebazzz 7y ago
Good chance one of the classic CAs will use this outage against Let's Encrypt though. Some classic CAs have been spreading a lot of FUD about Let's Encrypt.
- GuyPostington 7y ago
  Probably. What matters is the community response to the outage though. From what I saw there's been a ton of love for the team working through an entire Sunday.

hlieberman 7y ago

And this is the reason why Debian (and its derivs) ship a cron and systemd timer for you with certbot. You shouldn't have to think about or worry about this stuff. Certbot handles it for you.

copperx 7y ago
For some reason my cron task always fails to renew, and I have to manually renew at the last minute, when I notice the certificate has expired. This is for a personal site, so it doesn't matter. I tried many things, and can verify the cron task renews when I test it, but months later it always fails.
- laggyluke 7y ago
  Is your cron, by any chance, configured to run on every first day of month at midnight?
- hlieberman 7y ago
  Is this on Debian? There should be a log file created in /var/log/letsencrypt on each attempt; if you could send me one at my username @debian.org, or ping me on Freenode IRC, I may be able to help you debug. I'm guessing it's because your renew.conf's trying to use the "simple" authentication method which won't work if you've got a webserver running.
- mrighele 7y ago
  Not a solution to your problem, but if you supply an email when creating a certificate, you will receive a notification plenty in advance (three or four weeks, I think)
- schoen 7y ago
  You're welcome to join us on https://community.letsencrypt.org/ https://community.letsencrypt.org/ and we can help you debug this.
- johnchristopher 7y ago
  I receive a mail when certs are soon expired. I also set up traefik with auto renewal so it's a setup and forget thing now.

whatthesmack 7y ago

True, but still quite impactful for initial issuance being provided live to end users of things like Squarespace, Zendesk, Pardot, etc.

Thorrez 7y ago

The Caddy server can be configured to request a certificate while the user makes a request. That means things hosted in that manner might have downtime from this.