Upcoming Changes to Let's Encrypt Certificates

Re:Upcoming Changes to Let's Encrypt Certificates by ryandrake on Monday December 15, 2025 @06:11PM (#46282223)

I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly:

    0 2 1 * * /usr/local/bin/letsencrypt-renew

And the script:

    #!/bin/sh
    certbot renew
    service lighttpd restart
    service exim4 restart
    service dovecot restart

... and so on for all my services

That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by jacquesm on Monday December 15, 2025 @06:13PM (#46282260)

Yes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by account42 on Tuesday December 16, 2025 @09:33AM (#46288985)

If it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by noAnswer on Monday December 15, 2025 @10:17PM (#46284347)

I don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times.

I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd

My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by Dylan16807 on Tuesday December 16, 2025 @01:19AM (#46285383)

> I don't know how old "letsencrypt-renew" is and what it does.

It's the five lines below "the script:"

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by noAnswer on Tuesday December 16, 2025 @07:56PM (#46296895)

I'm sorry mister perfect. I officiously meant "certbot".

[ Parent | on HN ]

Re:Upcoming Changes to Let's Encrypt Certificates by Dylan16807 on Tuesday December 16, 2025 @09:39PM (#46297606)

I wasn't making fun of you. It wasn't obvious that's what you meant at all, because you said you didn't know "what it does". I'm sure you know what certbot does, so I thought you misinterpreted the post.

[ Parent | on HN ]