Hacker News Reader

Comment by LorenDB | Hacker News Reader

Super neat tool, but given that I use Caddy, that kinda prevents this issue from happening for me. While a monitoring tool is always a good idea, maybe the best long-term solution would be to encourage certificate auto-renewal tools. OTOH, I have only worked with this on a personal level, so maybe there's problems with auto-renewal that I haven't learned about.

View on HN

I auto renew all my certs via either AWS ACM or lego.

I also have monitoring that alerts me if a cert is nearing expiry.

I’ve been alerted several times and been able to correct bugs or hiccups that would have caused the live cert to expire.

Automation is not a replacement for monitoring: they are complementary.

> Automation is not a replacement for monitoring: they are complementary

absolutely. there are any number of reasons Caddy would be unable to renew the cert, just off the top of my head:

- LetsEncrypt has downtime or unavailability

- If you're doing dns-01 challenges for LE, whatever cred Caddy uses for that might expire / become invalidated.

- disk fills up (or gets unexpectedly remounted read-only) and Caddy is unable to write the renewed certs

Are there still instances where you would want an Extended Validation (EV) certificate? If so, that’s one case where certificate monitoring could be relevant.

Browsers today no longer provide visual indicators for EV certificates [1] so I don’t know if they’re still in common use.

[1]: https://en.wikipedia.org/wiki/Extended_Validation_Certificat... "Removal of special UI indicators"

> Are there still instances where you would want an Extended Validation (EV) certificate?

Not really.

> [...] I don’t know if they’re still in common use.

They are. The myth that they are somehow inherently more secure is still widespread.

Reply on news.ycombinator.com