3 ms·

> by definition you already automated the renewal process on a schedule too No, certbot does not run on a schedule by default. You have to set that up separat

by lisper 4y ago

> by definition you already automated the renewal process on a schedule too No, certbot does not run on a schedule by default. You have to set that up separately, and that can be non-trivial because you have to be able handle failures.

schoen 4y ago
If you installed it with pip, it doesn't; if you installed it with an OS package or snap, it does (although it also didn't in that case for about the first year and a half of its existence, I think).
- tomxor 4y ago
  Can confirm, I have been using certbot+apache in production across multiple servers from Ubuntu apt repos since 18.04 in 2018 and scheduled auto-renewal is the default.
cm2187 4y ago
But if certbot doesn't run on schedule, presumably it will never connect to ARI either.
mholt 4y ago
This is why Certbot should only be used temporarily to transition from legacy infrastructure. Ideally cert management (ACME client) needs to be baked into the server, like what Caddy does.
- adql 4y ago
  About the last thing security-wise that I want is for http server to control DNS record (which is required to have wildcard certs in LE)
  - mholt 4y ago
    When done properly, this is less of an attack vector than you think (certainly much less than a phishing email).