3 ms·

The problem is when the automation fails, you're back to manual. And decreasing the period between updates means more chances for failure. I've been flamed by H

The problem is when the automation fails, you're back to manual. And decreasing the period between updates means more chances for failure. I've been flamed by HN for admitting this, but I've never gotten automated L.E. certificate renewal to work reliably. Something always fails. Fortunately I just host a handful of hobby and club domains and personal E-mail, and don't rely on my domains for income. Now, I know it's been 90 days because one of my web sites fails or E-mail starts to complain about the certificate being bad, and I have to ssh into my VPS to muck around. This news seems to indicate that I get to babysit certbot even more frequently in the future.

LtWorf 11mo ago
I did manage to set it up and it has been working ok but it has been a PITA. Also for some reason they contact my server over HTTP, so I must open port 80 just to do the renovation.
- patmorgan23 11mo ago
  That would be because you set up the HTTP-01 challenge as your domain verification method. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
  - LtWorf 11mo ago
    Since there is no equivalent HTTPS way of doing the same thing?
    - aidenn0 11mo ago
      You can use DNS-01 or TLS-ALPN-01 if you don't want to (or can't) open up port 80.
eek2121 11mo ago
Really? I've never had it fail. I simply ran the script provided by LE, it set everything up, and it renewed every time until I took the site down for unrelated (financial reasons). Out of curiousity, when did you last use LE? Did you use the script they provided you or a third party package?
- ryandrake 11mo ago
  I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly: 0 2 1 * * /usr/local/bin/letsencrypt-renew And the script: #!/bin/sh certbot renew service lighttpd restart service exim4 restart service dovecot restart ... and so on for all my services That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.
  - jacquesm 11mo ago
    Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.
    - account42 11mo ago
      If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.
  - noAnswer 11mo ago
    I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times. I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.
    - Dylan16807 11mo ago
      > I don't know how old "letsencrypt-renew" is and what it does. It's the five lines below "the script:"
vrighter 11mo ago
I set it up last year and haven't had to interact with it in the slightest. It just works all the time for me.

LtWorf 11mo ago

I did manage to set it up and it has been working ok but it has been a PITA. Also for some reason they contact my server over HTTP, so I must open port 80 just to do the renovation.

patmorgan23 11mo ago
That would be because you set up the HTTP-01 challenge as your domain verification method. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
- LtWorf 11mo ago
  Since there is no equivalent HTTPS way of doing the same thing?
  - aidenn0 11mo ago
    You can use DNS-01 or TLS-ALPN-01 if you don't want to (or can't) open up port 80.

eek2121 11mo ago

Really? I've never had it fail. I simply ran the script provided by LE, it set everything up, and it renewed every time until I took the site down for unrelated (financial reasons). Out of curiousity, when did you last use LE? Did you use the script they provided you or a third party package?

ryandrake 11mo ago
I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly: 0 2 1 * * /usr/local/bin/letsencrypt-renew And the script: #!/bin/sh certbot renew service lighttpd restart service exim4 restart service dovecot restart ... and so on for all my services That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.
- jacquesm 11mo ago
  Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.
  - account42 11mo ago
    If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.
- noAnswer 11mo ago
  I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times. I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.
  - Dylan16807 11mo ago
    > I don't know how old "letsencrypt-renew" is and what it does. It's the five lines below "the script:"

vrighter 11mo ago

I set it up last year and haven't had to interact with it in the slightest. It just works all the time for me.