Hacker News Reader

Comment by deweller | Hacker News Reader

Will a nightly certbot invocation will replace these revoked certificates without manual intervention?

Apparently you have to manually use --force-renewal for certbot to regenerate new certificates (I just did it just in case, even though I'm 99% sure that I'm not concerned).

I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired.

I agree that it would be nice if there was such an option, although I assume that it would increase the server load significantly if certbot connected to letsencrypt's servers at every invocation so maybe that's why they didn't do it.

Actually i think it would not be a significant issue. At least for a range of situations. A static file with time stamp ranges in case of an issue could be resource-efficiently served to signal clients.

> I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired.

I think the actual issue here is that the certificates have not been revoked yet. We know that they will be revoked, which is why we have to run with --force-renewal, but there is no process for certbot to know that a certificate, although not revoked, will soon become revoked. I would expect certbot to automatically renew the next time its ran post-revocation.

Run `certbot renew --force-renewal`. That's what it says in the email they sent me. But if you didn't get an email, then your domains should not be affected.

My cert is affected, and I didn't get an email.

Check your domain using the linked online tool.

I didn't get the email, and my domains were affected. (Two of them are in the list, one of them current.)

I do get "you didn't renew your certificate" messages on a semi regular basis (domains that have passed out of my control) so I know they have my details.

Prior to today's 1.3.0 release, no; in versions of Certbot ≥ 1.3.0, yes.

I don't believe so.

I hope they add support for that soon.

It was included in the Certbot 1.3.0 release today.

https://community.letsencrypt.org/t/certbot-1-3-0-release/11...

(only certbot-auto users are likely to get this release immediately)

Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients ? The API is HTTP so presumably all clients could provide an HTTP user agent, although obviously some will show up as generic library defaults.

Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem? I confess if you'd asked me "What extra features does Certbot need?" I would not have listed "Check OCSP to trigger renewal" though in hindsight it's a good idea.

> Do you have analytics that give you some idea what fraction of subscribers use different versions of Certbot and other ACME clients?

Those do exist, though I don't personally have access to them. When things are calmer, you might ask bmw or jsha on the Let's Encrypt forum for some more information.

> Was this feature something already planned (albeit presumably not for release today) or was it entirely inspired by this problem?

I wrote (incomplete) code for this feature several years ago -- specifically inspired by the idea that certificates might sometimes be revoked unexpectedly -- but I don't think anyone planned to continue working on it until this problem came around.

Reply on news.ycombinator.com