Letsencrypt to end sending reminders by email this June

Did you not have any scripts to auto-renew?

I get email reminders but because I get so many emails (and have renewal scripts) I just never really paid attention to them. They’d be more useful if they were sent when a cert expired imo

Reading their announcement I feel that it is not problem with amount of money, it is operational problem, and they simply prefer to move that funds elsewhere. Looking at list of their sponsors I doubt that the money is the issue there.

@AstonJ @hauleth guys I understand you compleltey, but this points to a bigger problem, how we about address that before it becomes too late. I think the way it was started was perfect, let’s try to keep internet open, because it affects all of us. As stupid as it sounds, this is one of the biggest threats I’ve seen on OSS.

…OK but what threat?

I only had to do this once and just set up a calendar event with reminders 2 weeks before and then another one, 1 week before.

And as Aston said, there are scripts to auto-renew (I didn’t pursue this).

What did we “fail” as a community to support? They offered it for free, people took it for free, now they complain that it’s either too expensive, too troublesome, or both. They decide to cut the free email reminders but keep their core offer intact which is still free and super valuable. What’s the big deal?

I’m just relieved to know that I’m not the only one who hasn’t bothered to add this to cron I don’t have it set up to do it with zero downtime and there is a psychological factor of having control over/being “present” for the downtime. This should give me the kick I need to just to automate it, though.

I use Caddy and never have to worry about certs, OCSP stapling or other related things.

Honestly no matter what the reason is, it’s one less place in the web where we don’t have to keep our email addresses on the server side and that’s always a good thing especially that many of us don’t even have to do anything about it if automated scripts are working already. Also half year should be more than enough for others to prepare for it.

I have multiple sites setup with let’s encrypt and every one has auto renewal setup, but still sometimes the mail saved me when that renewal failed for some reason. So for me this is not a good evolution.

Certbot auto-setups auto-renew on debian and / or ubuntu hosts nowadays, I think I did not have to setup auto-renew myself since 2018.

If I recall correctly it runs everyday but as a dry run before it enters in a 19 day to expiration period where it actually does the renewal, so if something goes wrong you have 19 days to fix it.

@D4no0 would your SSLMoon product be able to check and warn for certs that come close to expiry ?

If you have a straight forward set-up you should be able to set up a simple cron job that runs certbot renew twice a day.

Alternatively you could set up your own script to check whether you are nearing expiry, then set it to email you on failure - or just get the script to fail if you have cron to email the server admin on failure of any cron jobs. In this case you could use something like this:

#!/bin/bash
  
# Read the domain from user input or set it as a variable
domain="forum.elixirforum.com"  # Replace with your domain or pass it as an argument

# Path to the certificate file
cert_file="/etc/letsencrypt/live/$domain/fullchain.pem"

# Check if the certificate file exists
if [[ ! -f "$cert_file" ]]; then
  echo "Certificate file not found: $cert_file"
  exit 1  # Fail with a non-zero exit code
fi

# Extract the expiration date of the certificate
expires=$(openssl x509 -enddate -noout -in "$cert_file" | cut -d= -f2)

# Convert the expiration date to a timestamp
expires_timestamp=$(date -d "$expires" +%s)

# Get the current timestamp
current_timestamp=$(date +%s)

# Calculate the number of seconds in two weeks (14 days)
two_weeks=$((14 * 24 * 60 * 60))

# Check if the certificate expires in less than two weeks
if [[ $((expires_timestamp - current_timestamp)) -lt $two_weeks ]]; then
  echo "The SSL certificate for $domain expires on $expires. Please renew it soon!"
  exit 1  # Fail with a non-zero exit code
fi

# If everything is fine, exit with success
exit 0

Please note this is untested! I used DeepSeek to help me convert parts of my old Ruby script to Bash.