Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Free Certificate Monitoring via RSS

raphting.dev

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Show HN: Free Certificate Monitoring via RSS

#21

Post by boricj »

ThePowerOfFuet wrote: post #18
boricj wrote: post #3

Neat! Recently my Synology NAS failed to automatically renew its Let's Encrypt certificate for my domain name and the certificate expired on my blog. I caught it the next day when my GoAccess metrics cratered (took some time to figure out since I normally use the QuickConnect domain name myself, whose certificate was fine), but it could've stayed broken for a very long time otherwise without me noticing. You got your…

QuickConnect has had serious security issues in the past, and I recommend very strongly against enabling or using it.

I've disabled it just now. I was basically only using it as an alias anyways.

I did take some very basic precautions otherwise (its firewall is configured to drop all non-local packets but for TCP ports 80 and 443), but at some point I'll have to host my blog properly instead of piggy-backing on a dinky, always-on NAS...

Re: Show HN: Free Certificate Monitoring via RSS

#23

Post by matrss »

divbzero wrote: post #13
LorenDB wrote: post #9

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

Are there still instances where you would want an Extended Validation (EV) certificate? If so, that’s one case where certificate monitoring could be relevant. Browsers today no longer provide visual indicators for EV certificates [1] so I don’t know if they’re still in common use. [1]: https://en.wikipedia.org/wiki/Extended_Validation_Certificat... "Removal of special UI indicators"

> Are there still instances where you would want an Extended Validation (EV) certificate?

Not really.

> [...] I don’t know if they’re still in common use.

They are. The myth that they are somehow inherently more secure is still widespread.

Re: Show HN: Free Certificate Monitoring via RSS

#25

Post by justsomehnguy »

You monitor for the failures ($currentDate > $cert.NotAfter), great.

What about soft failures, like connection problems? What if the cert is available but actually garbage? What if between 30 and 7 days the cert is changed?

And no, not checking FQDN against SAN is...

And finally, who monitors the monitoring?

Re: Show HN: Free Certificate Monitoring via RSS

#28

Post by mmsc »

dewey wrote: post #27

For transparency monitoring there's also https://crt.sh/?q=news.ycombinator.com which doesn't need a login, is free and has RSS support.

I used crtsh to discover certificates which were created in my previous company but I found about 20% of the time it returns some type of error (which is recoverable with a simple retry). Not sure if they fixed that, but I wouldn’t be surprised if a lot of companies use them and even profit from it somehow.

Re: Show HN: Free Certificate Monitoring via RSS

#29

Post by jackhalford »

justsomehnguy wrote: post #25

You monitor for the failures ($currentDate > $cert.NotAfter), great. What about soft failures, like connection problems? What if the cert is available but actually garbage? What if between 30 and 7 days the cert is changed? And no, not checking FQDN against SAN is... And finally, who monitors the monitoring?

No need to be snarky, clearly monitoring end user connections is a must. But the general idea of using RSS for monitoring is new to me, thanks for sharing!
Post reply on HN