Comment by jabart

Comment by jabart 2 days ago

7 replies

Six days? I can't even set the cron job to weekly. Maybe that is the point of this though from being on call I really hate thing restarting every day. Caddy, Nginx, HAProxy, and IIS all seem to handle certs without a full restart. MS SQL Server, nope.

mholt 2 days ago

AFAIK, Caddy is the only integrated ACME client that is tuned for short-lived certificates. All its own self-signed certs are already 24-hour certificates, so 6-day certs will be no problem.

  • yjftsjthsd-h 2 days ago

    Why would that matter? Replacing the cert and sighup'ing nginx or whatever isn't functionally different from doing it in-process.

    • apitman 2 days ago

      As someone who has rolled my own cert updates and used Caddy, I much prefer the Caddy way.

      • yjftsjthsd-h 2 days ago

        I'm happy to agree that caddy is easier, but the claim here is that it's "tuned for short-lived certificates", which... I guess could be true, but I seriously doubt that it's meaningful (on the basis that reloading certs isn't exactly expensive on any other major web server, so even if the most obvious interpretation is true and the made it take, say, 100 ms instead of 1000 ms, but we're talking about reloading every few days, who cares?).

    • mholt 2 days ago

      Oh, my, yes it is :) (I don't have time to elaborate on this again right now, unfortunately.)

      • jabart 2 days ago

        You have a link to a previous discussion on this? I'm curious if there is some hidden thing occurring or if just connection resets are happening or something else you are aware of.

petee 2 days ago

While it wouldn't help currently, I'm sure in time accomodations will be made - for example the acme-client on openbsd will only renew if <30 days from expiration, so it's crond weekly. A client will just need to support custom times, so call it daily and it will renew when 1 or 2 days out to be safe