5 ms·

Will a nightly certbot invocation will replace these revoked certificates without manual intervention?

by deweller 7y ago

londons_explore 7y ago
I don't believe so. I hope they add support for that soon.
- schoen 7y ago
  It was included in the Certbot 1.3.0 release today. https://community.letsencrypt.org/t/certbot-1-3-0-release/115107 https://community.letsencrypt.org/t/certbot-1-3-0-release/11... (only certbot-auto users are likely to get this release immediately)
  - tialaramex 7y ago
    Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients ? The API is HTTP so presumably all clients could provide an HTTP user agent, although obviously some will show up as generic library defaults. Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem? I confess if you'd asked me "What extra features does Certbot need?" I would not have listed "Check OCSP to trigger renewal" though in hindsight it's a good idea.
    - schoen 7y ago
      > Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients? Those do exist, though I don't personally have access to them. When things are calmer, you might ask bmw or jsha on the Let's Encrypt forum for some more information. > Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem? I wrote (incomplete) code for this feature several years ago -- specifically inspired by the idea that certificates might sometimes be revoked unexpectedly -- but I don't think anyone planned to continue working on it until this problem came around.
nitely 7y ago
Run `certbot renew --force-renewal`. That's what it says in the email they sent me. But if you didn't get an email, then your domains should not be affected.
- Tomte 7y ago
  My cert is affected, and I didn't get an email. Check your domain using the linked online tool.
- gindely 7y ago
  I didn't get the email, and my domains were affected. (Two of them are in the list, one of them current.) I do get "you didn't renew your certificate" messages on a semi regular basis (domains that have passed out of my control) so I know they have my details.
simias 7y ago
Apparently you have to manually use --force-renewal for certbot to regenerate new certificates (I just did it just in case, even though I'm 99% sure that I'm not concerned). I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired. I agree that it would be nice if there was such an option, although I assume that it would increase the server load significantly if certbot connected to letsencrypt's servers at every invocation so maybe that's why they didn't do it.
- tehlike 7y ago
  Actually i think it would not be a significant issue. At least for a range of situations. A static file with time stamp ranges in case of an issue could be resource-efficiently served to signal clients.
- lightswitch05 7y ago
  > I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired. I think the actual issue here is that the certificates have not been revoked yet. We know that they will be revoked, which is why we have to run with --force-renewal, but there is no process for certbot to know that a certificate, although not revoked, will soon become revoked. I would expect certbot to automatically renew the next time its ran post-revocation.
schoen 7y ago
Prior to today's 1.3.0 release, no; in versions of Certbot ≥ 1.3.0, yes.

Will a nightly certbot invocation will replace these revoked certificates without manual intervention?

londons_explore 7y ago

I don't believe so. I hope they add support for that soon.

schoen 7y ago
It was included in the Certbot 1.3.0 release today. https://community.letsencrypt.org/t/certbot-1-3-0-release/115107 https://community.letsencrypt.org/t/certbot-1-3-0-release/11... (only certbot-auto users are likely to get this release immediately)
- tialaramex 7y ago
  Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients ? The API is HTTP so presumably all clients could provide an HTTP user agent, although obviously some will show up as generic library defaults. Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem? I confess if you'd asked me "What extra features does Certbot need?" I would not have listed "Check OCSP to trigger renewal" though in hindsight it's a good idea.
  - schoen 7y ago
    > Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients? Those do exist, though I don't personally have access to them. When things are calmer, you might ask bmw or jsha on the Let's Encrypt forum for some more information. > Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem? I wrote (incomplete) code for this feature several years ago -- specifically inspired by the idea that certificates might sometimes be revoked unexpectedly -- but I don't think anyone planned to continue working on it until this problem came around.

nitely 7y ago

Run `certbot renew --force-renewal`. That's what it says in the email they sent me. But if you didn't get an email, then your domains should not be affected.

Tomte 7y ago
My cert is affected, and I didn't get an email. Check your domain using the linked online tool.
gindely 7y ago
I didn't get the email, and my domains were affected. (Two of them are in the list, one of them current.) I do get "you didn't renew your certificate" messages on a semi regular basis (domains that have passed out of my control) so I know they have my details.

simias 7y ago

Apparently you have to manually use --force-renewal for certbot to regenerate new certificates (I just did it just in case, even though I'm 99% sure that I'm not concerned). I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired. I agree that it would be nice if there was such an option, although I assume that it would increase the server load significantly if certbot connected to letsencrypt's servers at every invocation so maybe that's why they didn't do it.

tehlike 7y ago
Actually i think it would not be a significant issue. At least for a range of situations. A static file with time stamp ranges in case of an issue could be resource-efficiently served to signal clients.
lightswitch05 7y ago
> I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired. I think the actual issue here is that the certificates have not been revoked yet. We know that they will be revoked, which is why we have to run with --force-renewal, but there is no process for certbot to know that a certificate, although not revoked, will soon become revoked. I would expect certbot to automatically renew the next time its ran post-revocation.

schoen 7y ago

Prior to today's 1.3.0 release, no; in versions of Certbot ≥ 1.3.0, yes.