Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Free Certificate Monitoring via RSS

raphting.dev

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Show HN: Free Certificate Monitoring via RSS

#11

Post by akerl_ »

LorenDB wrote: post #9

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

I auto renew all my certs via either AWS ACM or lego.

I also have monitoring that alerts me if a cert is nearing expiry.

I’ve been alerted several times and been able to correct bugs or hiccups that would have caused the live cert to expire.

Automation is not a replacement for monitoring: they are complementary.

Re: Show HN: Free Certificate Monitoring via RSS

#13

Post by divbzero »

LorenDB wrote: post #9

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

Are there still instances where you would want an Extended Validation (EV) certificate? If so, that’s one case where certificate monitoring could be relevant.

Browsers today no longer provide visual indicators for EV certificates [1] so I don’t know if they’re still in common use.

[1]: https://en.wikipedia.org/wiki/Extended_Validation_Certificat... "Removal of special UI indicators"

Re: Show HN: Free Certificate Monitoring via RSS

#14

Post by cloin »

Cool! I have a strange affinity for RSS and created* a small plugin to subscribe to feeds within Event-Driven Ansible** and run actions on new feed posts. I didn't create it with specific utility in mind, certificate monitoring via RSS fits right in there - much to my surprise.

* - https://github.com/cloin/cloin.eda/blob/main/docs/rss.rst

** - https://github.com/ansible/ansible-rulebook

Re: Show HN: Free Certificate Monitoring via RSS

#15

Post by [deleted] »

LorenDB wrote: post #9

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

[deleted]

Re: Show HN: Free Certificate Monitoring via RSS

#16

Post by xofer »

> No guarantees are given, for nothing

This is a double negative. Depending on how you interpret the comma, it could mean "guarantees are given for everything." (Pointing this out in case you intend to protect yourself from liability with this statement.)

Re: Show HN: Free Certificate Monitoring via RSS

#18

Post by ThePowerOfFuet »

boricj wrote: post #3

Neat! Recently my Synology NAS failed to automatically renew its Let's Encrypt certificate for my domain name and the certificate expired on my blog. I caught it the next day when my GoAccess metrics cratered (took some time to figure out since I normally use the QuickConnect domain name myself, whose certificate was fine), but it could've stayed broken for a very long time otherwise without me noticing. You got your…

QuickConnect has had serious security issues in the past, and I recommend very strongly against enabling or using it.

Re: Show HN: Free Certificate Monitoring via RSS

#20

Post by philsnow »

akerl_ wrote: post #11
LorenDB wrote: post #9

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

I auto renew all my certs via either AWS ACM or lego. I also have monitoring that alerts me if a cert is nearing expiry. I’ve been alerted several times and been able to correct bugs or hiccups that would have caused the live cert to expire. Automation is not a replacement for monitoring: they are complementary.

> Automation is not a replacement for monitoring: they are complementary

absolutely. there are any number of reasons Caddy would be unable to renew the cert, just off the top of my head:

- LetsEncrypt has downtime or unavailability

- If you're doing dns-01 challenges for LE, whatever cred Caddy uses for that might expire / become invalidated.

- disk fills up (or gets unexpectedly remounted read-only) and Caddy is unable to write the renewed certs

Post reply on HN