3 ms·

I wanted to view your website, but the SSL certificate expired yesterday (fingerprint 01:03:F8:89:77:72:11:C2:BC:45:12:E9:EF:04:8E:21:D8:BC:77:83:81:26:B4:38:6E

by chaz6 6y ago

I wanted to view your website, but the SSL certificate expired yesterday (fingerprint 01:03:F8:89:77:72:11:C2:BC:45:12:E9:EF:04:8E:21:D8:BC:77:83:81:26:B4:38:6E:9C:81:A6:4B:07:C2:70).

berkes 6y ago
Thanks for the warning. This is one of my last servers with nginx. Nginx and letsencrypt is ... cumbersome, unstable; once every few months I have to manually reboot and/or renew the certs. ugh. Time to move this one to Caddy too.
- sitzkrieg 6y ago
  or just make a cronjob to restart nginx after you run certbot
  - berkes 6y ago
    Going offtopic here; but this is exactly the problem. There is a cronjob that restarts nginx after a certbot rerun. This makes at least three assumptions, all of which will fail at some point: 1. certbot does not need to stop nginx to renew a cert (some modes do). 2. the certbot run succeeded (all certs have been renewed, no network issues, etc) 3. all certs are written correctly so that nginx config is valid (can reach and parse the certs) In this particular case, for some reason, one of the 7 sites hosted here had a misconfigured DNS, letsencrypt servers could not reach it, certbot failed, no nginx restart was attempted. This case falls in #1, fixable by force-reloading nginx every day after certbot run regardless of whether a cert has been renewed. All solutions with nginx are cludges like that. Don't get me wrong: certbot/letsencrypt is miles ahead of automation before they came along (I've built en ran several hosting companies, certs automation is a disgrace), but it remains hacky, cludgy and therefore unstable and somewhat unreliable.
    - sitzkrieg 6y ago
      huh i hear ya, but really the only thing ive ran into is updating certs not taking till nginx restart, in fact im suspect certbot might restart it for you at this point. i dont doubt it drops on the floor in any intermittent outages which isn't unheard of when it runs every 3 months

by chaz6 6y ago

I wanted to view your website, but the SSL certificate expired yesterday (fingerprint 01:03:F8:89:77:72:11:C2:BC:45:12:E9:EF:04:8E:21:D8:BC:77:83:81:26:B4:38:6E:9C:81:A6:4B:07:C2:70).

berkes 6y ago

Thanks for the warning. This is one of my last servers with nginx. Nginx and letsencrypt is ... cumbersome, unstable; once every few months I have to manually reboot and/or renew the certs. ugh. Time to move this one to Caddy too.

sitzkrieg 6y ago
or just make a cronjob to restart nginx after you run certbot
- berkes 6y ago
  Going offtopic here; but this is exactly the problem. There is a cronjob that restarts nginx after a certbot rerun. This makes at least three assumptions, all of which will fail at some point: 1. certbot does not need to stop nginx to renew a cert (some modes do). 2. the certbot run succeeded (all certs have been renewed, no network issues, etc) 3. all certs are written correctly so that nginx config is valid (can reach and parse the certs) In this particular case, for some reason, one of the 7 sites hosted here had a misconfigured DNS, letsencrypt servers could not reach it, certbot failed, no nginx restart was attempted. This case falls in #1, fixable by force-reloading nginx every day after certbot run regardless of whether a cert has been renewed. All solutions with nginx are cludges like that. Don't get me wrong: certbot/letsencrypt is miles ahead of automation before they came along (I've built en ran several hosting companies, certs automation is a disgrace), but it remains hacky, cludgy and therefore unstable and somewhat unreliable.
  - sitzkrieg 6y ago
    huh i hear ya, but really the only thing ive ran into is updating certs not taking till nginx restart, in fact im suspect certbot might restart it for you at this point. i dont doubt it drops on the floor in any intermittent outages which isn't unheard of when it runs every 3 months