4 ms·
> 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout There’s your answer. 6 days means on a long enough
by halifaxbeard 9mo ago
> 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout
There’s your answer.
6 days means on a long enough enough timeframe the load will end up evenly distributed across a week.
8 days would result in things getting hammered on specific days of the week.
- PunchyHamster 9mo ago> 6 days means on a long enough enough timeframe the load will end up evenly distributed across a week. people will put */5 in cron and result will be same, because that's obvious, easy and nice number.
- bayindirh 9mo agoACME doesn't renew certificates when there's enough time, so it'll always renew around 6 days, even if you check more aggressively. Currently ACME sets its cron job to 12 days on 90 day certificates.
- akerl_ 9mo agoWhich ACME client are you referring to?
- phantom784 9mo agoI'd have it renew Monday and Thursday to avoid weekend outages.
- Dylan16807 9mo agoIf they put */5 in cron, a single error response will break their site and the beginning of March will also break their site.
- PunchyHamster 9mo agoand they will replace it with * and just do it every day just in case
- teaearlgraycold 9mo agoI’d expect most will do this. I wouldn’t be surprised if LE expects this.
- Dylan16807 9mo agoRunning an update script every day is good. Certbot defaults to running twice a day. Just use something with similar logic, waiting to renew short-lived certificates until halfway through their validity period. That way the actual load is nice and spread out. And you should get that logic by default if you do a normal setup.
- cpach 9mo agoIf I would use short-lived certs I would make sure to choose an ACME client that has support for ARI (ACME Renewal Information). Then the CA will tell the client when it’s time to renew.
- blibble 9mo agoso now people that want humans around will now renew twice in a week instead of once?
- Dylan16807 9mo agoOh definitely not. They don't want humans doing any renewals.
- nojs 9mo agoI thought people generally run it daily? It’s a no-op if it doesn’t need renewal.