Comment

Comment on Decreasing Certificate Lifetimes to 45 Days

I’m using automated renewals.

But, that just means there’s a new cert file on disk. Now I have to convince a half a dozen different apps to properly reload that changed cert. That means fighting with Systemd. So Systemd has won the first few skirmishes, and I haven’t had the time or energy to counterattack. Now instead of having to manually poke at it 4x per year, it’s going to be closer to once a month. Ugh.

source

Sort:hotnew top

nialv7@lemmy.world ⁨3⁩ ⁨days⁩ ago
Half a dozen sounds like a lot, kinda curious what you are running? If they all are web services maybe use a reverse proxy or something?

source
- merc@sh.itjust.works ⁨2⁩ ⁨days⁩ ago
  Web services, and then various components of an email system.
  
  source
  - JadedBlueEyes@programming.dev ⁨2⁩ ⁨days⁩ ago
    If you have the time to set it up, Stalwart can manage its own cert renewal.
    
    source
    merc@sh.itjust.works ⁨2⁩ ⁨days⁩ ago
    I don’t want to have to completely redo my whole email stack.
    
    source
    -> View More Comments
NotMyOldRedditName@lemmy.world ⁨3⁩ ⁨days⁩ ago
Don’t worry, they’ll sell you new software for another $50.00/m to help with the new certificate fiddling you now have to do monthly.

source
eclipse@lemmy.world ⁨3⁩ ⁨days⁩ ago
You could try a path unit watching the cert directory (there are caveats around watching the symlinks directly) or most acme implementations have post renewal hooks you can use which would be more reliable.

source