4 ms·

Email is both cheap and very not cheap. Once you hit a moderate level of scale, the bill starts to add up. At LE's scale, I imagine it costs a lot to send out

Email is both cheap and very not cheap. Once you hit a moderate level of scale, the bill starts to add up. At LE's scale, I imagine it costs a lot to send out that email. If the value isn't there, then personally I'd rather they focus their funds on other efforts. Personally, I was saved by one email for a cert renewal that was failing, but the majority of them are irrelevant because of my automations. Are these emails useful to people?

stackskipton 2y ago
As SRE, I guarantee someone somewhere is manually running certbot to get a new certificate when they get expiration email from Let's Encrypt.
- chrisandchris 2y ago
  I do, for some hosts I'm to lazy to setup DNS validation and which are services which are not HTTP-based, but still use TLS/SSL (so no exposed 80/443 to the web). It's nice to get reminded of the expiring cert and it takes me every 3 months like 5min to renew the cert for 2-3 hosts. To lazy to automate me 15mins.
- gioazzi 2y ago
  https://xkcd.com/1172/ https://xkcd.com/1172/
mjw1007 2y ago
Probably not. Letsencrypt don't provide a way to tell them "I'm not using this certificate any more", so they send out so many false-positive warnings that they're likely to drown out any signal. Every time I move a service to a machine using a different letsencrypt account, or add a domain to a certificate, I get an unactionable warning email.
- dextercd 2y ago
  Pretty sure you don't get an email if you revoke the certificate
jonas21 2y ago
Like you, I was saved by this once. I had a certificate with multiple domain names [1], and decided not to renew one of the domains. That caused the certificate renewal to fail, even though I was still serving content on the other domains. The email alerted me to this - and that alone made it worth it for me, even with all the noise. But I can understand LE's position, especially since there are other options for setting up free certificate monitoring. [1] I didn't even realize I was doing this - it's just how certbot set things up based on my nginx configuration.

stackskipton 2y ago

As SRE, I guarantee someone somewhere is manually running certbot to get a new certificate when they get expiration email from Let's Encrypt.

chrisandchris 2y ago
I do, for some hosts I'm to lazy to setup DNS validation and which are services which are not HTTP-based, but still use TLS/SSL (so no exposed 80/443 to the web). It's nice to get reminded of the expiring cert and it takes me every 3 months like 5min to renew the cert for 2-3 hosts. To lazy to automate me 15mins.
gioazzi 2y ago
https://xkcd.com/1172/ https://xkcd.com/1172/

mjw1007 2y ago

Probably not. Letsencrypt don't provide a way to tell them "I'm not using this certificate any more", so they send out so many false-positive warnings that they're likely to drown out any signal. Every time I move a service to a machine using a different letsencrypt account, or add a domain to a certificate, I get an unactionable warning email.

dextercd 2y ago
Pretty sure you don't get an email if you revoke the certificate

jonas21 2y ago

Like you, I was saved by this once. I had a certificate with multiple domain names [1], and decided not to renew one of the domains. That caused the certificate renewal to fail, even though I was still serving content on the other domains. The email alerted me to this - and that alone made it worth it for me, even with all the noise. But I can understand LE's position, especially since there are other options for setting up free certificate monitoring. [1] I didn't even realize I was doing this - it's just how certbot set things up based on my nginx configuration.