4 ms·

> And that is why we run it. But we still monitor. The difference for me is that Let's Encrypt has required this kind of manual intervention more often than th

> And that is why we run it. But we still monitor. The difference for me is that Let's Encrypt has required this kind of manual intervention more often than the previous status quo. Previously, I would put an item on my calendar to renew the free StartSSL cert, would do it on schedule, and things would generally go off without a hitch. For me, the automatic renewer has fallen apart multiple times (for several reasons, including failing to reload nginx after renewing the cert), more than once a year on average, and worse still, they don't fail on any kind of regular schedule. I'm not a pro, just someone who wants a cert for my personal site, so I don't have any complicated monitoring system set up. This means I have to regularly remember to check up on certbot and see if it renewed the cert this time.

throw0101a 6y ago
We've had one minor hiccup when LE changed the company that they used for front-end load balancing, but other than that it's set and forget. Generally we don't think about LE/ACME at all at $WORK. We still have some annually-renewed certs for 'appliances', including a wildcard, but practically we don't think about either 'system' more than the other. If spending $x per year solves the problem for you, then go for it, but it does seem odd to me that you're having so many problems. As for monitoring, a simple thing to do is to install some well-tested, pre-canned check scripts (e.g., from Nagios): * https://packages.debian.org/search?keywords=monitoring-plugins https://packages.debian.org/search?keywords=monitoring-plugi... and have them kick off via cron on a regular basis. A non-zero error code will cause an e-mail to be sent to you. While we use Nagios (for now) to monitor from a central host, we also leverage them in things like keepalived for running HA clusters to trigger fail-overs. No sense re-inventing the wheel.

throw0101a 6y ago

We've had one minor hiccup when LE changed the company that they used for front-end load balancing, but other than that it's set and forget. Generally we don't think about LE/ACME at all at $WORK. We still have some annually-renewed certs for 'appliances', including a wildcard, but practically we don't think about either 'system' more than the other. If spending $x per year solves the problem for you, then go for it, but it does seem odd to me that you're having so many problems. As for monitoring, a simple thing to do is to install some well-tested, pre-canned check scripts (e.g., from Nagios): * https://packages.debian.org/search?keywords=monitoring-plugins https://packages.debian.org/search?keywords=monitoring-plugi... and have them kick off via cron on a regular basis. A non-zero error code will cause an e-mail to be sent to you. While we use Nagios (for now) to monitor from a central host, we also leverage them in things like keepalived for running HA clusters to trigger fail-overs. No sense re-inventing the wheel.