Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

61–70 of 112 posts

Re: LetsEncrypt Outage

#61

Post by ninjin »

greyface- wrote: post #17

Good time to note that Buypass offers free certificates over ACME. I have a few of my domains configured to use them instead of LetsEncrypt, just for redundancy and to ensure I have a working non-LE cert source in case LE suffers problems like this over a longer time period. Example OpenBSD /etc/acme-client.conf: authority buypass { api url "https://api.buypass.com/acme/directory" account key "/etc/acme/buypass-privk…

Cheers! They look like decent chaps and also outside the US for some additional certificate diversity. Are there other trustworthy Acme issuers out there?

A pity that acme-client(1) does not allow for fallbacks, but I will add a mental note about it being an easy enough patch to contribute if I ever find the time.

Re: LetsEncrypt Outage

#62

Post by kevincox »

andrewmcwatters wrote: post #53
mixdup wrote: post #26

Earlier quoted context omitted.

They have been communicating the ending of the email notices for quite a while and have been telling users that you should have some other monitoring in place to avoid just this situation

Yes, but what’s weird is the recommended service they referred people to for new email notifications was not… sending me emails. So, what gives?

Yeah the recommended service is awful and not nearly as useful as the one they had is.

Which is disappointing because you should be able to recreate the service they had nearly exactly with certificate transparency logs.

Re: LetsEncrypt Outage

#63

Post by tbrownaw »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

Re: LetsEncrypt Outage

#64

Post by rfv6723 »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

I use self-hosted gatus to monitor my certs and other services' status.

It can send alerts to multiple alerting providers.

https://github.com/TwiN/gatus

Re: LetsEncrypt Outage

#66

Post by VenturingVole »

jasonthorsness wrote: post #13
kenshaw wrote: post #12

Earlier quoted context omitted.

I encountered this while trying to issue a new certificate for a service. As a temporary fix, started using ZeroSSL which conveniently also supports the ACME protocol. While not a big problem, if you have something like `cert-manager` being used on Kubernetes, then it requires quite a bit of reconfiguration, and you may spend a couple hours trying to figure out why a certificate hasn't been issued yet. That said, I'm…

Let's Encrypt was a huge deal right from the beginning. They truly moved the web forward. Here is the HN announcement: https://news.ycombinator.com/item?id=8624160 Announcement "animated" https://hn.unlurker.com/replay?item=8624160

Truly was a radical advancement. Makes me wonder, a decade from now what will it be that we look back upon with a similar perspective?

Re: LetsEncrypt Outage

#67

Post by Jedd »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

> Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet.

This sounds like an easy problem to identify root cause for.

I think I received about 15 'we're disabling email notifications soon' emails over the past several months - one of which was interesting, but none were needed, as I'd originally set this up, per documentation, to auto-renew every 30 days.

Perhaps create a calendar reminder for the short term?

Re: LetsEncrypt Outage

#68

Post by jtchang »

greyface- wrote: post #56
NooneAtAll3 wrote: post #41

Earlier quoted context omitted.

what's the alternative to PKI?

https://en.wikipedia.org/wiki/Decentralized_identifier

So basically you trust something because you have a long chain of assurances that you trusted it before? Kinda like certificate pinning.

Re: LetsEncrypt Outage

#69

Post by [deleted] »

andrewmcwatters wrote: post #53
mixdup wrote: post #26

Earlier quoted context omitted.

They have been communicating the ending of the email notices for quite a while and have been telling users that you should have some other monitoring in place to avoid just this situation

Yes, but what’s weird is the recommended service they referred people to for new email notifications was not… sending me emails. So, what gives?

[deleted]

Re: LetsEncrypt Outage

#70

Post by ocdtrekkie »

phillipseamore wrote: post #52
rocqua wrote: post #31

Earlier quoted context omitted.

That ship has sailed. DNSsec is not liked even a little bit. Given that control over DNS is how domain validated certs are handed out, it would make a lot of sense to cut out the middle man. But DNS does not have a good reliable authenticated transport mechanism. I wonder if there was a way to build this that would have worked.

My biggest problem is how centralized issuance is. Half the year I live on an island that is reliant on submarine cables and has historically had weeks and months long outages and with a changing world I suspect that might become reality once again. Locally this wasn't much of an issue, the ccTLD continues to function, most services (but now about 35%) are locally hosted. Then HTTPS comes along. Zero certificates cou…

Realistically there's no reason except Google retaining centralized control of the Internet for there to be a specific group of trusted CAs that meet Google's arcane specifications which can issue certificates the entire world trusts.

Your registrar should be able to validate your ownership of the domain, ergo your registrar should be your CA. Instead of a bunch of arbitrary and capricious rules to be trusted, a CA should not be "trusted" by the browser, but only able to sign certificates for domains registered to it.

Post reply on HN