4 ms·

Really? I've never had it fail. I simply ran the script provided by LE, it set everything up, and it renewed every time until I took the site down for unrelated

by eek2121 10mo ago

Really? I've never had it fail. I simply ran the script provided by LE, it set everything up, and it renewed every time until I took the site down for unrelated (financial reasons). Out of curiousity, when did you last use LE? Did you use the script they provided you or a third party package?

ryandrake 10mo ago
I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly: 0 2 1 * * /usr/local/bin/letsencrypt-renew And the script: #!/bin/sh certbot renew service lighttpd restart service exim4 restart service dovecot restart ... and so on for all my services That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.
- jacquesm 10mo ago
  Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.
  - account42 10mo ago
    If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.
- noAnswer 10mo ago
  I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times. I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.
  - Dylan16807 10mo ago
    > I don't know how old "letsencrypt-renew" is and what it does. It's the five lines below "the script:"
    - noAnswer 10mo ago
      I'm sorry mister perfect. I officiously meant "certbot".
      - Dylan16807 10mo ago
        I wasn't making fun of you. It wasn't obvious that's what you meant at all, because you said you didn't know "what it does". I'm sure you know what certbot does, so I thought you misinterpreted the post.

by eek2121 10mo ago

ryandrake 10mo ago

I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly: 0 2 1 * * /usr/local/bin/letsencrypt-renew And the script: #!/bin/sh certbot renew service lighttpd restart service exim4 restart service dovecot restart ... and so on for all my services That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.

jacquesm 10mo ago
Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.
- account42 10mo ago
  If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.
noAnswer 10mo ago
I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times. I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.
- Dylan16807 10mo ago
  > I don't know how old "letsencrypt-renew" is and what it does. It's the five lines below "the script:"
  - noAnswer 10mo ago
    I'm sorry mister perfect. I officiously meant "certbot".
    - Dylan16807 10mo ago
      I wasn't making fun of you. It wasn't obvious that's what you meant at all, because you said you didn't know "what it does". I'm sure you know what certbot does, so I thought you misinterpreted the post.