freebsd security - Sep 2019 - Let's Encrypt

On Mon, Sep 9, 2019, at 6:12 AM, Trond Endrest?l wrote:
> On Mon, 9 Sep 2019 16:06+0700, Victor Sudakov wrote:
> 
> > The majority is for py-certbot, so I'll probably use it. Thank
you.
> 
> I have found it prudent to run certbot twice a month from cron(8), 
> just to be safe.
> 
> Last year, I had one case where the certificate expired a few hours 
> before the next run of certbot. Had I run certbot on the 1st and on 
> the 15th day of each month, then the certificates would have been 
> updated ahead of their expiration.
> 
> E.g.:
> 
> #minute	hour	mday	month	wday	who	command
> 
> 52	4	1	*	*	root	certbot renew --quiet --pre-hook "service apache24 
> stop" --post-hook "service apache24 start"
> 52	1	15	*	*	root	certbot renew --quiet --pre-hook "service apache24 
> stop" --post-hook "service apache24 start"

Whereas, I run acme.sh on a daily basis. My goal: renew certificates at their
earliest possibility. This gives me the maximum time to fix any issues.

I combine the above with monitoring to raise alerts if any tickets have less
than 28 days left before they expire.

Should the cert-renewal process not run on a given day, no big deal, it runs the
next day. I had considered running it less frequently, but settled on daily.

-- 
  Dan Langille
  dan at langille.org

On 2019-09-09 14:26, Dan Langille wrote:
> Whereas, I run acme.sh on a daily basis. My goal: renew certificates at
their earliest possibility. This gives me the maximum time to fix any issues.
> 
> I combine the above with monitoring to raise alerts if any tickets have
less than 28 days left before they expire.
Same here: Nagios will alert me in case acme.sh is not doing its job 
(daily), although this has almost never happened.

  bye
	av.