Hacker News Reader

Comment by jbob2000 | Hacker News Reader

jbob2000·

> One of my favourite functions (certinfo) reports back on when you're LetsEncrypt SSL certificate is going to expire. How handy is that?

I can't help but feel that this is over-engineering to its highest degree. What is a calendar for? Create an event in Google Calendar or whatever and have it notify you a few days in advance. Completely non-technical solution that everybody already knows how to do.

View on HN

Not at all. Let's say you manage 100 machines, possibly for different domains, and each generates their own certs. Now you probably want monitoring that alerts you when the certificate is about to expire in the next 20 days (you can renew them 30 days before they expire, without running into rate limit shenanigans).

With 100 servers, you'll have on average about two calendar entries per day, most of which are no-ops, because the certificate renewal worked fine.

You certainly do not need "infinite scaling" to do that. Just a queue of workers running on a dumb server or even just a crontab... Yes it is the very definition of over engineering.

No, you don't need "infinite scaling" for just that. But if you have a FaaS-Setup anyway, you might as well reuse it for such relatively simple (but still useful) tasks.

A full Linux kernel and cron daemon for that? You could run it on an ESP32!

You know that LE will email you if a cert isn't automatically renewed, right?

Anecdotally, the case of "certificate renewed, but setup not properly configured to reload all services afterwards" happens quite a bit.

See also: updating vulnerable library packages but not restarting dependent daemons.

Wasn't the whole point of LetsEncrypt's short certificate expiration period to promote setting up automatic renewal?

So no more calendar reminders every year, having to look up what's the correct order to concatenate comodo's chain and so on.

Reply on news.ycombinator.com