3 ms·

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

akerl_ 3y ago
I auto renew all my certs via either AWS ACM or lego. I also have monitoring that alerts me if a cert is nearing expiry. I’ve been alerted several times and been able to correct bugs or hiccups that would have caused the live cert to expire. Automation is not a replacement for monitoring: they are complementary.
- philsnow 3y ago
  > Automation is not a replacement for monitoring: they are complementary absolutely. there are any number of reasons Caddy would be unable to renew the cert, just off the top of my head: - LetsEncrypt has downtime or unavailability - If you're doing dns-01 challenges for LE, whatever cred Caddy uses for that might expire / become invalidated. - disk fills up (or gets unexpectedly remounted read-only) and Caddy is unable to write the renewed certs
divbzero 3y ago
Are there still instances where you would want an Extended Validation (EV) certificate? If so, that’s one case where certificate monitoring could be relevant. Browsers today no longer provide visual indicators for EV certificates [1] so I don’t know if they’re still in common use. [1]: https://en.wikipedia.org/wiki/Extended_Validation_Certificate#Removal_of_special_UI_indicators https://en.wikipedia.org/wiki/Extended_Validation_Certificat... "Removal of special UI indicators"
- matrss 3y ago
  > Are there still instances where you would want an Extended Validation (EV) certificate? Not really. > [...] I don’t know if they’re still in common use. They are. The myth that they are somehow inherently more secure is still widespread.
deleted 3y ago
[deleted]

akerl_ 3y ago

I auto renew all my certs via either AWS ACM or lego. I also have monitoring that alerts me if a cert is nearing expiry. I’ve been alerted several times and been able to correct bugs or hiccups that would have caused the live cert to expire. Automation is not a replacement for monitoring: they are complementary.

philsnow 3y ago
> Automation is not a replacement for monitoring: they are complementary absolutely. there are any number of reasons Caddy would be unable to renew the cert, just off the top of my head: - LetsEncrypt has downtime or unavailability - If you're doing dns-01 challenges for LE, whatever cred Caddy uses for that might expire / become invalidated. - disk fills up (or gets unexpectedly remounted read-only) and Caddy is unable to write the renewed certs

divbzero 3y ago

Are there still instances where you would want an Extended Validation (EV) certificate? If so, that’s one case where certificate monitoring could be relevant. Browsers today no longer provide visual indicators for EV certificates [1] so I don’t know if they’re still in common use. [1]: https://en.wikipedia.org/wiki/Extended_Validation_Certificate#Removal_of_special_UI_indicators https://en.wikipedia.org/wiki/Extended_Validation_Certificat... "Removal of special UI indicators"

matrss 3y ago
> Are there still instances where you would want an Extended Validation (EV) certificate? Not really. > [...] I don’t know if they’re still in common use. They are. The myth that they are somehow inherently more secure is still widespread.

deleted 3y ago

[deleted]