Expired Cert

[FanIn80]

Hey, you've probably already figured this out, but someone (photon?) needs to renew your cert(s).

[photon]

Yeah sorry, I usually have a calendar item to remind me to renew the cert, but I either missed it or the periodic entry expired.

Will renew as soon as I can.

[PeteMoss]

yeah.. getting the 'this site is unsafe' warning on chrome.

[Hack&Lube]

You should be able to configure auto-renewal with letsencrypt

[GioforPM]

[BlackArcher101]

How can I see the site for more than 5 seconds without having to click through the chrome warning?

[Hack&Lube]

Originally Posted by BlackArcher101

How can I see the site for more than 5 seconds without having to click through the chrome warning?

It's not possible until the cert is in place because of how modern browsers are designed. I tried http but it redirects to https which requires an SSL cert

You could try a different browser, but on my chrome it seems to remember I say to continue even though it was unsafe and it has remembered the setting so far.

[photon]

Ok should be renewed.

Originally Posted by Hack&Lube

You should be able to configure auto-renewal with letsencrypt

Yeah there are different ways, basically involves running a command on a computer to request the renewal from LetsEncrypt, they do a verification, and then copy the new certs.

Easy enough script to write.

Problem is I thought I'd be clever and do a wildcard cert so I could easily setup whatever subdomain sites I'd want. However the wildcard cert verification involves setting DNS TXT entries. So I'd have to get the challenge string, update a couple of DNS TXT records via API, then do the verification.

The previous DNS provider didn't have an easy API to work with so I'd been doing it manually.

There's a new DNS provider that comes along with the ads but I haven't checked to see if they have API access.

What I'll probably just have to do is switch to certs for each individual domain rather than a wildcard because those can be verified by having a text file available on the domain URL. Or maybe check their docs to see if there's any new verification options available.

[BlackArcher101]

Hurray, thanks Photon!

[Hack&Lube]

Originally Posted by photon

Ok should be renewed.



Yeah there are different ways, basically involves running a command on a computer to request the renewal from LetsEncrypt, they do a verification, and then copy the new certs.

Easy enough script to write.

Problem is I thought I'd be clever and do a wildcard cert so I could easily setup whatever subdomain sites I'd want. However the wildcard cert verification involves setting DNS TXT entries. So I'd have to get the challenge string, update a couple of DNS TXT records via API, then do the verification.

The previous DNS provider didn't have an easy API to work with so I'd been doing it manually.

There's a new DNS provider that comes along with the ads but I haven't checked to see if they have API access.

What I'll probably just have to do is switch to certs for each individual domain rather than a wildcard because those can be verified by having a text file available on the domain URL. Or maybe check their docs to see if there's any new verification options available.

Could you have a single cert with a variety of subject alternative names of the sub domains you want (SANs) instead of the wildcard?

[photon]

Hm good suggestion, it appears it does, and it doesn't mention the DNS challenge verification so I assume it'd just be a normal challenge text file for each subdomain.

[kermitology]

SAN certs would definitely work!

[photon]

I changed it so it generated a cert with multiple SANs rather than a wildcard.. the nice thing is I can specify the web root in the command and it'll put in a challenge file that it'll read, so doesn't require creating challenge TXT records in the DNS which was super annoying.

Thanks!

[Ped]

CPHL site is down with no certificate.

[photon]

Ah it's running cphlsim.calgarypuck.com and I don't have that in the cert.

Should be an easy fix.

[photon]

Ok cert was updated with that domain, doing a hard refresh on a roster page seemed to work for me.