PSA: LetsEncrypt ending expiration notification emails

[ikidd@lemmy.world]

I think it's a good idea, everyone should be automating this anyway.

[eskuero@lemmy.fromshado.ws]

I did setup UptimeKuma for notifications on this. let's see if it works out when the expiry arrives in a month

[kokesh@lemmy.world]

I just wish I wouldn't have to renew certs so often.

[skyntp@lemmy.ml]

I think it's a good idea, everyone should be automating this anyway.

This is still not possible in all scenarios. For example, wildcard certificates for DNS providers with no API support.

[shortn0te@lemmy.ml]

Then swap you nameservers to a DNS provider that allows that?

[jimmycakes@lemmy.world]

Mine just auto renews anyway

[maggiwuerze@feddit.org]

I think I'll need to add notifications for my uptime kuma as well now. So far I've used it mostly for historical data but without the mails, I would like to get a notice

[doughless@lemmy.world]

If Apple gets their way, you'll be renewing every month:

https://certera.com/blog/apples-proposal-to-shorten-ssl-tls-certificate-lifespans-to-45-days-by-2027/

[bjoern_tantau@swg-empire.de]

You're not supposed to do it manually.

[kokesh@lemmy.world]

My server does it automatically, but I have few services I can't make to read the certs from server storage, so I have to manually copy cert content. Especially Adguard Home for some reason refuses to read my certs.

[bjoern_tantau@swg-empire.de]

Have the same problem. But symlinks or copying them via cron solved it for me.

[ramble81@lemm.ee]

There are a lot of embedded systems that do not offer API support to swap out certificates. Things like switches, dvr, nas devices, etc.

[ramble81@lemm.ee]

Tell that to all the embedded device manufacturers… switches, appliances, nas, etc.

There’s a whole load of things that will have a massive administrative burden if the frequency is dropped.

[verstra@programming.dev]

UptimeKuma looks nice. Simple, but it does what it is supposed to.

[rmuk@feddit.uk]

Honestly in rare situations that a device like that needs to be accessible from the wild Internet I think it'd be mad to expose it directly, especially if it's not manageable as you suggest. At the very least, I'd be leaning on a reverse proxy.

[ramble81@lemm.ee]

That implies though I don’t want valid certificates in my environment. I still want to make sure even on my private network I’m using valid certs. A lot of security departments require that too even if the device isn’t public facing.

[ohvenus_baby@lemmy.ml]

Fuck Apple and Microshit

[tofuwabohu@slrpnk.net]

Have you tried to automate it?

[cm0002@lemmy.world]

still want to make sure even on my private network I’m using valid certs. A lot of security departments require that too even if the device isn’t public facing.

Is there a hard source with evidence that this is at all needed? Because there are a lot of things that "security departments" do that amount to security theater. Like forcing arbitrary password changes org wide.

[tofuwabohu@slrpnk.net]

If you're using Prometheus, Blackbox exporter checks cert expiration as well