6 ms·
LetsEncrypt Certificate Issuance Halted
- zinekeller 5y agoI'll be honest, this is still better than some more 'professional' CA issuers which sometimes just stops for a whole day. I hope that day is spent on audits and not like because their update regime doesn't support on-the-fly (or virtually on-the-fly by having two or more signing machines) updates.
- daniel-s 5y agoThe halt happened twice, but only lasted ~25 mins each time. It was back running before the arrival of most of the people that will end up getting to this post.
- LeoPanthera 5y agoAlready restarted, was unavailable for 29 minutes. At the time of writing, performance is degraded.
- wyrm 5y ago... for less than half an hour.
- cheeze 5y agoSpoke too soon? Looks like they halted again.
- deleted 5y ago[deleted]
- eloeffler 5y agoLooks like they continued again
- abracadaniel 5y agoIt still shows as degraded performance overall, so will probably be intermittent for a while. Pretty cool that they’re providing that level of transparency actually.
- pulse7 5y agoI like Let's Encrypt's free certificates! But I don't like centralization where failure in a centralized service may render millions of websites inaccessible... It is somehow against the spirit of the "inter-net" where many independent networks and computers are connected and work even if some fail...
- kenniskrag 5y agoThat's why we renew our certs more than one day in advance.
- cblconfederate 5y agoI assume most people have a cron job to do that. The thing is, if it fails for a number of consecutive times then you won't be able to renew it for a period of time IIRC.
- kenniskrag 5y agoThe cron should run always. They have a rate limit for the amount of renewed certs. This doesn't apply if you don't reach their servers or don't get a cert. But if you have a problem with a CA just switch to another which supports your bot (e.g. acme compliant CAs).
- tialaramex 5y agoRight, if your scripts can screw up, after the CA issued a certificate, their costs are locked in, (and thus Let's Encrypt rate limits apply here) and you should make effort to be able to recover the key and certificate if you fail rather than start over. The private key only you have, so that's the thing you most need to avoid throwing away over and over due to a bug. If you lose the certificate, that's a public document, you can just get another copy manually if necessary.
- iso1631 5y agoIf you renew 30 days ahead of schedule, your monitoring presumably goes red at least 2 weeks before expiry so you have plenty of notice to fix it.
- sam0x17 5y agoThings are under a lot of strain today. I noticed AWS lambda went down earlier today for 4 of my clients using completely unrelated stacks in different regions, but AWS status page was all green.
- b0afc375b5 5y agoHere's a series of comments discussing why status pages are unreliable: https://news.ycombinator.com/item?id=25213817 https://news.ycombinator.com/item?id=25213817 Edit: My main takeaway is that it goes against the human instinct of self preservation (losing one's job, opening the company to lawsuits, status pages being used against you by competitor, etc.)
- sebiw 5y agoThis is why most Let's Encrypt clients start renewal some x days before certificate expiration. 'Sall good. ;-)
- SahAssar 5y agoI think by default it is 30 days (at least for acme.sh), so you have renewal every two months and a month to fix any issues.
- PikachuEXE 5y agoAnd I generally do it every month in case there are some unexpected issue. 1 more month for me to fix stuff (or wait for fix).
- melgafin 5y agoacmed uses 3 weeks (28 days), seems reasonable as well.
- zekica 5y agoSorry to nitpick, but 3 weeks are 21 days.
- chuckSu 5y agoAre you really sorry?
- withinboredom 5y agoI guess that depends on how you count. If starting from 0, it is 3, or if you don’t count the last week as a full week, it’s also 3.
- throwaway472927 5y agoIf you start weeks at 0, you should do the same for days, 3 weeks = 27 days
- ddtaylor 5y agoI'm fine with the outage LetsEncrypt overall has been great and they should take their time fixing whatever is wrong.
- can16358p 5y agoYup. Great free service. Also this practically would only disrupt new registrations as there is more than enough time window for renewals anyway.
- geocrasher 5y agoLest anyone think that such issues only happen to free providers, check out Sectigo's status page: https://sectigo.status.io/pages/history/5938a0dbef3e6af26b001921 https://sectigo.status.io/pages/history/5938a0dbef3e6af26b00... For context, Sectigo also provides freebies for cPanel customers.
- 9dev 5y agoThey have, like, an incidence every two days? That's utterly disturbing, does anyone actually pay them?
- technion 5y agoFor political reasons we buy a tonne of their certificates. It's not uncommon that I'll paste a CSR into the interface and just get a quality error like "Unhandled Exception", which basically tells me that they fixed it. Because back when it was Comodo I used to see full page stack traces.
- Xylakant 5y agoThe blue ones are planned maintenance and reading the contents indicates that it's mostly changes and fixes for the customer-facing UI. It may be a bit excessive to post all of these, but they certainly don't indicate any sort of problematic issue with their software.
- deleted 5y ago[deleted]
- bennyp101 5y agoI guess this really only affects those wanting to get new certificates for new (sub)domains. For renewals, this is not a problem unless it's down for an extended period of time - and even then there would be time to switch providers. Should be using scheduled updates, and even if not, the email notifications come in on 20 and 10 days, so plenty of time to go and get it renewed.
- cpach 5y agoAFAICT users of Caddy would not have been affected since Caddy can fallback from one CA to another. Pretty clever! https://caddyserver.com/docs/automatic-https#overview https://caddyserver.com/docs/automatic-https#overview
- ThalesX 5y agoI'll be honest, this title worried me a lot more than the Facebook is down one.
- ipiz0618 5y agoWow the title got me worried. Luckily it's an outage not a shutdown.
- chrisMyzel 5y agoAnybody who's affected by this clearly is too late in renewing =)