Hacker News Reader

Comment by lol768 | Hacker News Reader

I'm curious, which email does it use to register with? I didn't see one in the config file.

[It uses the value of the global ServerAdmin setting][1]:

> There are 2 additional settings that are necessary for a Managed Domain: ServerAdmin and MDCertificateAgreement. The mail address of ServerAdmin is used to register at the CA (Let's Encrypt by default). The CA may use it to notify you about changes in its service or status of your certificates.

[1]: https://httpd.apache.org/docs/trunk/mod/mod_md.html#managedd...

Supplying an email address to Let's Encrypt is optional.

... but if you don't supply one of course Let's Encrypt won't notify you about anything.

So if you aren't paying attention you may get blind-sided by any future change, particularly if your use case is weird e.g. you can only pass http-01 by HTTP 301 redirecting to a machine with a completely different hostname, works today, could get outlawed as dangerous one day and they'd have the records to show you're going to be affected, but no way to automatically warn you.

I recommend always monitoring server logs as a last line of defense (or first, honestly) for these kinds of things.

Do Apache's server logs notify you if your cert is about to expire, but hasn't yet?

I doubt it does in general, but mod_md does have a pretty chatty log if you enable it. Haven't tested this specifically, but I assume it prints something around renewal time.

Expiration dates on your TLS certs is usually something that you want to monitor and alert on anyway. I'd actually build the monitoring separately from the renewal process, just in case that the renewal process doesn't notice that it fails.

As a good first step, it's easy to configure the Prometheus blackbox exporter (or your TLS-supporting blackbox scraper of choice) to report the TLS cert expiry date; I have an alert which pages me if a TLS cert will expire in a week or sooner based on this.

Reply on news.ycombinator.com