!MthpOIxqJhTgrMNxDS:nixos.org

NixOS ACME / LetsEncrypt

114 Members
Another day, another cert renewal46 Servers

You have reached the beginning of time (for this room).


SenderMessageTime
20 Feb 2025
@hexa:lossy.networkhexa
   --ari-disable                             Do not use the renewalInfo endpoint (draft-ietf-acme-ari) to check if a certificate should be renewed. (default: false)
18:07:53
@thinkchaos:matrix.orgThinkChaos Did they remove --ari-enable or do they have both now? 😄 18:08:48
@emilazy:matrix.orgemilyis 0 "no wait" or "indefinite"?20:31:12
@hexa:lossy.networkhexano wait aiui20:55:07
@hexa:lossy.networkhexayes, ari is default on now and you can disable it20:55:20
21 Feb 2025
@emilazy:matrix.orgemily

You’ll also want to be sure your ACME client is running frequently - both for the sake of renewing short-lived certificates and so as to take advantage of ACME Renewal Information (ARI). ARI allows Let’s Encrypt to notify your client if it should renew early for some reason. ARI checks should happen at least once per day, and short-lived certificates should be renewed every two to three days, so we recommend having your client run at least once per day.

16:04:44
@emilazy:matrix.orgemilywonder if we should consider moving to 2×/day16:04:52
@emilazy:matrix.orgemily(https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/)16:04:57
22 Feb 2025
@m1cr0man:m1cr0man.comm1cr0manI mean we only ever had it > 1 day for LE's sake (DDOS) 😅 I don't see why we couldn't do 2x/day. Sorry just catching up on this all now. Was on holidays.00:26:31
@hexa:lossy.networkhexaideally we could configure the intervals relative to the total certificate lifetime14:50:52
@hexa:lossy.networkhexa* ideally we could configure the intervals relative to the total certificate lifetime provided by the profile14:51:01
@hexa:lossy.networkhexabut in the end it probably doesn't matter too much14:51:41
@hexa:lossy.networkhexaI still worry a bit about shortlived certs and CT logs14:52:13

Show newer messages


Back to Room ListRoom Version: 6