4 ms·

>Today all of the above is possible with certificate transparency logs, but nobody looks in them, so they're useless. I check mine once or twice a month manual

>Today all of the above is possible with certificate transparency logs, but nobody looks in them, so they're useless. I check mine once or twice a month manually, but it is pretty trivial to monitor it automatically as well, e.g. there are APIs for crt.sh or they even offer direct public read access to their database. I believe certificate users should remain responsble for their own monitoring. Alerting as you say would be very annoying since you couldn't preemptively replace certs without getting alerted unecesarily, and it would divert Let's Encrypt developer resources away from more useful projects.

londons_explore 7y ago
> very annoying since you couldn't preemptively replace certs You would sign your request for a new cert with the private key of your old cert, proving you are the same person, which would suppress the alert. Obviously the key provisioning tooling would do that automatically, so you needn't do it manually.
technion 7y ago
I built this project to make such automated monitoring easier: https://ctadvisor.lolware.net https://ctadvisor.lolware.net
- smartbit 7y ago
  Love the site, great sense of humor. Wish you all the best with this project.
  - technion 7y ago
    Many thanks! And thank you to the people that signed up to try it out.
- wwn_se 7y ago
  Seems like a great solution, I will test it for a few domains. Multi domain registration could be nicer ;)
im3w1l 7y ago
Maybe you actually need the security, but a lot of people just got certificates to avoid browser warnings. Saying every non-technical guy with a blog they update once a year should set up their own monitoring is a ridiculous ask.
hrez 7y ago
https://developers.facebook.com/tools/ct/ https://developers.facebook.com/tools/ct/ You can check your domains there or subscribe for email notifications.
GFischer 7y ago
Many LetsEncrypt users are one-man shops or side project owners, they don't WANT another burden like monitoring certificates that doesn't add to the bottom line (yes, I know a non-working certificate will be very painful for a side project).

londons_explore 7y ago

> very annoying since you couldn't preemptively replace certs You would sign your request for a new cert with the private key of your old cert, proving you are the same person, which would suppress the alert. Obviously the key provisioning tooling would do that automatically, so you needn't do it manually.

technion 7y ago

I built this project to make such automated monitoring easier: https://ctadvisor.lolware.net https://ctadvisor.lolware.net

smartbit 7y ago
Love the site, great sense of humor. Wish you all the best with this project.
- technion 7y ago
  Many thanks! And thank you to the people that signed up to try it out.
wwn_se 7y ago
Seems like a great solution, I will test it for a few domains. Multi domain registration could be nicer ;)

im3w1l 7y ago

Maybe you actually need the security, but a lot of people just got certificates to avoid browser warnings. Saying every non-technical guy with a blog they update once a year should set up their own monitoring is a ridiculous ask.

hrez 7y ago

https://developers.facebook.com/tools/ct/ https://developers.facebook.com/tools/ct/ You can check your domains there or subscribe for email notifications.

GFischer 7y ago

Many LetsEncrypt users are one-man shops or side project owners, they don't WANT another burden like monitoring certificates that doesn't add to the bottom line (yes, I know a non-working certificate will be very painful for a side project).