4 ms·
This is why I do not like the "every 90 days" on Let's Encrypt Even if automated, actually especially if automated, that's four times a year you can have compl
by ck2 7y ago
This is why I do not like the "every 90 days" on Let's Encrypt
Even if automated, actually especially if automated, that's four times a year you can have complete site failure if something goes wrong.
ps. would be nice if firefox could easily override expired certs for advanced users like self-signed certs
- cpncrunch 7y agoEven though the certs are 90 days, the script renews the cert 30 days before it is due to expire. Typically you will run the script once per week via crontab, so you'll get emailed once a day with a message saying either it has renewed the cert, or it isn't ready for renewal. IMO Let's Encrypt is the best way to manage an SSL cert these days.
- karatestomp 7y agoFor my hobbyist-tier and personal web stuff I'm pretty annoyed at how active webserver management is becoming, largely over SSL stuff. No more setting up Apache and enabling auto-security-updates for your package manager then not touching the server for years. I get why but it still kinda sucks.
- cpeterso 7y agoTechCrunch's new cert expires in two years. Who at TechCrunch will remember to renew that cert in February 2022? If they had to renew certs every 90 days, they most likely would not have forgotten. Cert renewal would be automated or part of regular quarterly planning.
- praveenweb 7y agoNow Safari will no longer trust certs valid for more than 13 months. Recent discussion thread about it https://news.ycombinator.com/item?id=22398063 https://news.ycombinator.com/item?id=22398063
- GuyPostington 7y agoYou know you could monitor your certs to verify that your client is functioning correctly. There's also notification emails if you provide your email address at issuance time.
- tmpz22 7y agoThis is not super friendly either because even if you identify an issue early there are many rabbit holes of failure, ratelimiting, and tool integration, that make it a PITA to deal with. Being good at catching errors doesn't soften the blow of the errors being so readily occurring in the first place.
- GuyPostington 7y ago> Being good at catching errors doesn't soften the blow of the errors being so readily occurring in the first place. Yes it does. If you can see the errors you can change your usage pattern or request a rate limit override. Flying blind is the worst way to go!