Cert update dates

chudak

Makes sense, changed to 90 days, and added the script to Certificate options Actions list (not sure if it will send email, but will be seeing in the logs for sure)

Thx!

jimp

Why would you want to wait until the certificate has already expired before you renew it?

Leave it at 60 and ignore it unless it fails to renew. The default settings are best.

chudak

@jimp

I’m trying to find best way to be remained to do some manual actions for one certificate that is being managed by acme.

For pfsense 60 days overlapping/advanced updates will work fine.

But I need to get some emails in order to copy new certificate to my other server. (need to see how further automate this process)

Thx all for suggestions and useful tips

jimp

Waiting for it to expire to get an e-mail from Let's Encrypt seems like an incredibly bad idea.

Next time, lead with what you are trying to accomplish. There are likely much better ways to achieve your ultimate goal without relying on hacks.

chudak

@jimp said in Cert update dates:

Waiting for it to expire to get an e-mail from Let's Encrypt seems like an incredibly bad idea.

Next time, lead with what you are trying to accomplish. There are likely much better ways to achieve your ultimate goal without relying on hacks.

Waiting for expansion sounds like extreme, there would be several emails.

“We send the first notice at 20 days before your certificate expires, and more notices at 10 days and 1 day before it expires.”

That’s what I’m looking for - what’s the better way?

Derelict

Pretty sure you can make something like Nagios alert you if a certificate changes. Been a while since I looked. Certainly a log host can watch for certain events and do it, as has been mentioned.

Gertjan

@chudak said in Cert update dates:

not sure if it will send email

??
You test a script when you create it. If it works - then you 'activate' it by using it as an 'action'.
Never ever use a script automatically, that is, for example, by a cron script.
Test first. Check all the 'input' variables, that they are available at any time.

"90 days" is no good. If anything goes wrong, you'll find out when it it to late.
"Let's Enscrypts" advises themselves to renew after 60 days, which mans that you have 30 days to have a a look at it when something goes wrong.

chudak

@Gertjan said in Cert update dates:

'activate' it by using it as an 'action'

where? Services/Acme/Certificate options: Edit/-> Action List ?

Gertjan

Yep, see my image above.
Hit the green Add button, and add it.

chudak

@Gertjan said in Cert update dates:

Yep, see my image above.
Hit the green Add button, and add it.

I did that, so I guess I will get an email on next renewal.

Thx

Gertjan

Hit the Renew button yourself right now. You'll see.
You are allowed to renew yourself, like 5 times a week.