4 ms·
I've been using autocert (golang.org/x/crypto/acme/autocert) to fetch and renew certificates. A few weeks ago, I added new subdomains to my site, and noticed th
by smasher164 6y ago
I've been using autocert (golang.org/x/crypto/acme/autocert) to fetch and renew certificates. A few weeks ago, I added new subdomains to my site, and noticed that it wasn't being issued new certificates.
After searching for the error in the logs, I landed here: https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 https://community.letsencrypt.org/t/end-of-life-plan-for-acm.... I missed the whole ACMEv1 deprecation notice. I thought autocert would take care of this (and it does), except I had not updated to the latest version of the library. Everything was resolved after updating the library, but I still had to clear my local HSTS to verify. This would not have been acceptable if there were actual traffic going to that subdomain.
I guess the lesson to learn is that even though many of the barriers to automatic certificate renewal have been removed, I still have to keep up to date on breaking changes and deprecation notices, especially if updates only happen every couple of years.
- paxys 6y agoThe real lesson is to always have automated monitoring and alerting in place for everything. Certificate renewal, API schemas, service dependencies, core libraries and protocols - everything can and does change without notice. You could have a single dependency on www.google.com and it would still eventually break.