3 ms·
I assume most people have a cron job to do that. The thing is, if it fails for a number of consecutive times then you won't be able to renew it for a period of
by cblconfederate 5y ago
I assume most people have a cron job to do that. The thing is, if it fails for a number of consecutive times then you won't be able to renew it for a period of time IIRC.
- kenniskrag 5y agoThe cron should run always. They have a rate limit for the amount of renewed certs. This doesn't apply if you don't reach their servers or don't get a cert. But if you have a problem with a CA just switch to another which supports your bot (e.g. acme compliant CAs).
- tialaramex 5y agoRight, if your scripts can screw up, after the CA issued a certificate, their costs are locked in, (and thus Let's Encrypt rate limits apply here) and you should make effort to be able to recover the key and certificate if you fail rather than start over. The private key only you have, so that's the thing you most need to avoid throwing away over and over due to a bug. If you lose the certificate, that's a public document, you can just get another copy manually if necessary.
- iso1631 5y agoIf you renew 30 days ahead of schedule, your monitoring presumably goes red at least 2 weeks before expiry so you have plenty of notice to fix it.