Hacker News Reader

Comment by ck2 | Hacker News Reader

This is why I do not like the "every 90 days" on Let's Encrypt

Even if automated, actually especially if automated, that's four times a year you can have complete site failure if something goes wrong.

ps. would be nice if firefox could easily override expired certs for advanced users like self-signed certs

View on HN

Even though the certs are 90 days, the script renews the cert 30 days before it is due to expire. Typically you will run the script once per week via crontab, so you'll get emailed once a day with a message saying either it has renewed the cert, or it isn't ready for renewal.

IMO Let's Encrypt is the best way to manage an SSL cert these days.

TechCrunch's new cert expires in two years. Who at TechCrunch will remember to renew that cert in February 2022? If they had to renew certs every 90 days, they most likely would not have forgotten. Cert renewal would be automated or part of regular quarterly planning.

Now Safari will no longer trust certs valid for more than 13 months. Recent discussion thread about it https://news.ycombinator.com/item?id=22398063

For my hobbyist-tier and personal web stuff I'm pretty annoyed at how active webserver management is becoming, largely over SSL stuff. No more setting up Apache and enabling auto-security-updates for your package manager then not touching the server for years. I get why but it still kinda sucks.

You know you could monitor your certs to verify that your client is functioning correctly. There's also notification emails if you provide your email address at issuance time.

This is not super friendly either because even if you identify an issue early there are many rabbit holes of failure, ratelimiting, and tool integration, that make it a PITA to deal with.

Being good at catching errors doesn't soften the blow of the errors being so readily occurring in the first place.

> Being good at catching errors doesn't soften the blow of the errors being so readily occurring in the first place.

Yes it does. If you can see the errors you can change your usage pattern or request a rate limit override. Flying blind is the worst way to go!

Reply on news.ycombinator.com