Hacker News new | ask | show | jobs
by k__ 3143 days ago
LE is awesome.

Clients want an SSL server and it lets me set it up in 10 minutes without additional costs.

1 comments

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.
Why use a cron job? I have certbot running in one Docker container, the .well-known route directing to the one dedicated Docker host running certbot, and whenever certbot renews the certificate, it writes the cert to the NAS share that is only mounted on the LBs and then triggers a SIGKILL to the haproxy docker containers (which causes haproxy to re-read the cert file and configuration).

Fully automated, no cronjobs to fail. In addition, I have a monitoring on all LBs that verifies the expiration time - it has never hit so far. That cronjob/monitoring is something everyone should have anyway because a well working monitoring system can alert you to so many other possible failure states...

> I have certbot running in one Docker container, the .well-known route directing to the one dedicated Docker host running certbot, and whenever certbot renews the certificate, it writes the cert to the NAS share that is only mounted on the LBs and then triggers a SIGKILL to the haproxy docker containers (which causes haproxy to re-read the cert file and configuration).

Is this really more stable than a simple cronjob? It is far more complicated, for sure, so there should be significant benefits to make up for that.

You just described a far more complicated setup then a simple cron job.
Well, depending on how you install certbot, it sets up a cron job automatically for you (on Debian, anyway). It's no big deal - it just creates the cron file /etc/cron.d/certbot.

I'm curious as to how you get certbot to renew automatically without a cron job or some sort of script in the Docker container that periodically runs 'certbot renew'.

Thank you for explaining the details of an alternative method. I have not advanced that far in my deployment skills, yet!
Right?! "Sure I won't think about this for a year, then I'll remember it 30 days before I need to have it fixed, it'll be great".
Or "I won't have to think about this for three years, and everything will keep working during that time, and I don't have to worry about a cron job failing"

I don't mind offering 90 day certificates, but requiring it goes against the offered reason of LE to expand HTTPS.