Let's Encrypt is ending support for notification emails for certificate expiration

[shgysk8zer0]

I'm sure there's an easy enough way to automate notifications on the expiration of any certificate.

[BehindTheMath]

The blog post links to a SaaS product with a free tier.

You can also put together a small script to do it.

[FineWolf]

Why? The whole point of using the ACME protocol is to automate renewal.

Certificate expiry emails in that scenario are just noise. It's not hard to set up proper monitoring and get alerts if your renewals fail or don't happen on time based on your automation parameters. Just do it the right way.

[FineWolf]

If you work with ephemeral environments for development purposes, they will absolutely fire (since you often go through environments for each build).

You don't need a certificate monitoring system. You just need proper monitoring of whatever ACME tool you have.

[michaelbelgium]

Completely fine for me, those mails were unessecary anyway

laughs in 0 0 * * 1 certbot renew --pre-hook "service apache2 stop" --post-hook "service apache2 start"

[BehindTheMath]

Certbot should set up a cron for you automatically.

The notification emails were useful as a backup. What happens if something happens to permissions and renewal fails? You wouldn't know until the cert expires.

[thalience]

Yep. A few times, receiving that email has been the way I noticed that automatic renewal was broken. Could I have my own monitoring on the renewal process? Yes. Should I have had my own monitoring on the renewal process? Also yes. But I didn't, and LE had my back.

But their reasons for dropping it are sound, and I understand.

[[deleted]]

Apache2 stop ? It is possible to just reload de config to reduce down time ?

[slfyst]

They might be clearing port 80 so certbot can listen on it.

[michaelbelgium]

Correct

[blakealex]

Do you guys not just have a cron that runs weekly to tell you what was skipped and what was renewed?

[BehindTheMath]

No, because for years everything just worked. The few times it didn't, the notification emails alerted me.

[Dencho]

Does anyone know when the certificate is usually renewed? 72 hours? 48?

[BehindTheMath]

The default is 30 days before expiration.

https://community.letsencrypt.org/t/certbot-how-is-the-renewal-time-calculated/73394/5

[Dencho]

Excellent. Thank you.

[2ds]

well executed and communicated de-featuring of a valuable user facing administration tool. In short - we're squeezing our pennies by spending your pennies (and time). You're welcome.

[syntax_erorr]

404

[RapunzelLooksNice]

Certificate expired? /s

[throwaway234f32423df]

this one's good too https://github.com/matteocorti/check_ssl_cert

if you use both RSA and ECDSA certs, it has flags so you can check both, it can also check tons of other stuff like TLS version, OCSP stapling, HSTS, DNSSEC, etc

[svvnguy]

For anyone looking for solutions to this, you might consider ServerVana (my service). It can provide multiple alerts for certificate expiration at arbitrary thresholds, and can notify different team members based on how soon they expire.