Hex.pm Certificate expired Jul. 31 2025

mindreframer

I hope somebody is aware of it.

24 comments

#hex

1 1291 24

2025-08-01 17:34:01 UTC

Showing Posts 1 to 10

Show Best Posts
Show All (oldest first)
Show All (newest first)

sanswork

https://github.com/hexpm/hexpm/issues/1317

I’m following this for updates so I don’t have to just keep refreshing

Post #1

sodapopcan

Wait, is someone manually updating hex.pm’s letsencrypt certificate based off of the email reminders that recently stopped? I was doing this with a client and they emailed me today about this very issue because I kept telling myself every three months “Oh right, I gotta set up a cron for this, ugh… I’ll do it this afternoon…”

Post #2

mindreframer

Thanks, did not know this was already a known issue. 4 hours already…

Post #3

mindreframer

thats Claude telling me it’s quite possible to have those certificates renewed like 30 days before they expire… that way there is plenty of time to intervene manually in case of some automated renewal issues.

I’ve been on the other side of having those kinds of things ruining my day, so please don’t take this as an smart-ass reply. We are all human after all.

# Let's Encrypt Certificate Early Renewal Guide

## Overview

Yes, you can absolutely renew a Let's Encrypt certificate well before it expires! This is not only possible but considered best practice for maintaining secure SSL/TLS certificates.

## Key Facts

- Let's Encrypt certificates are valid for **90 days**
- **Recommended renewal time**: 30 days or less remaining
- Early renewal provides a safety buffer in case of renewal issues
- Automatic renewal systems typically trigger at the 30-day mark

## Manual Renewal Commands

### Force Immediate Renewal
```bash
certbot renew --force-renewal

Check Certificate Status

certbot certificates

Test Renewal Process (Dry Run)

certbot renew --dry-run

Automatic Renewal Setup

Cron Job Example

Most systems benefit from automated renewal checks. Here’s a typical cron entry that runs twice daily:

# Add to crontab (crontab -e)
0 12 * * * /usr/bin/certbot renew --quiet

Systemd Timer

Many modern Linux distributions use systemd timers instead of cron:

# Check if certbot timer is active
systemctl status certbot.timer

# Enable automatic renewal
systemctl enable certbot.timer
systemctl start certbot.timer

Best Practices

Set up automatic renewal - Don’t rely on manual renewals
Monitor renewal logs - Check that automatic renewals are working
Use dry-run testing - Verify your renewal process works before you need it
Renew at 30 days remaining - This is the sweet spot for timing
Have monitoring in place - Get alerts if renewals fail

Alternative ACME Clients

If you’re not using Certbot, other popular ACME clients also support early renewal:

acme.sh - Lightweight shell script alternative
Traefik - Reverse proxy with built-in ACME support
Caddy - Web server with automatic HTTPS
cert-manager - Kubernetes certificate management

Rate Limits

Let’s Encrypt has rate limits, but they’re generous for normal use:

50 certificates per registered domain per week
5 duplicate certificates per week (same set of hostnames)

The --force-renewal flag will create a duplicate certificate, so use it sparingly.

Troubleshooting

If renewal fails, common issues include:

Webserver configuration blocking the challenge
Firewall blocking port 80 or 443
DNS changes affecting domain validation
File permissions on certificate directories

Always test with --dry-run first to catch issues without hitting rate limits.

Post #4

sodapopcan

That was the sentiment of my comment. I know I can set up a cron, I know when it can be done (without asking AI), but I just didn’t… partially because in a weird way I enjoy doing it manually (I only have one freelance client as I work work a full time job, if I had more I would have nipped this in the bud long ago). So I was delighting at the idea that maybe (and it probably isn’t even the case) that an owner of hex is doing the same

Post #5