Hey people. I’m working on figuring out the best way to implement letsencrypt into my web server. I’ve been poking around but still have some general questions: First, it appears you can put many totally different domain names into one SAN certificate? (as opposed to just doing sub domains of the s…

I thought I read somewhere that the reason they want you to renew twice a day is incase your certificate is revoked for some reason? Wouldn’t it make sense to renew hourly then, so if that happens, it will get cleared up fast without missing any traffic? They said, I have no idea what kind of probl…

[image] l008com: the reason they want you to renew twice a day is in case your certificate is revoked for some reason? That would require checking all certs for revocation - that does require resources on LE side. [an http call to LE's OCSP server would be required] After some searching... …

Well that's interesting because when I do either: certbot renew or certbot certificates After it lists certificates, give me pathes, dates, tells me it's not old enough to be renewed etc, I also get the following note: OCSP check failed for /etc/letsencrypt/live/fellsbiker.com/cert.pem (ar…

It gets the OCSP settings (URL) from the cert and then uses it to verify the status. So, it would seem that your system has limited access outbound.

Limited access outbound? Are you saying firewall? That’s unlikely because my firewall does not block any outbound connections, only inbound. If that’s not what you mean, then… what do you mean?

See: [image] Unable to verify OCSP response Server I…

[image] rg305: So, then, hourly may actually put undue “stress” on the OCSP system. [I would stick with the recommended] The main limited resource for Let's Encrypt is the HSM hardware used to sign certificates and OCSP responses. In both cases, this is proportional to certificate issuance v…

I just read that whole post but I don’t understand it unfortunately.

It tries to shows how to verify OCSP manually. [which is pretty much what cerbot would do every time it is called]

But what is OCSP verification? Why do I need it? Do I need it? Is it a problem that cerbot fails to do it when I renew my certs? Can I safely just ignore that, or is that something I have to look in to?

Beginner Questions

Help

rg305 February 14, 2019, 3:47pm 15

See:

Topic		Replies	Views
Problem with Certbot renew Help	58	3020	October 31, 2020
Update Script Failing... Wait, no come back! Help	39	3108	June 1, 2018
Double checking that I did everything right before requesting real cert Help	23	5417	January 21, 2016
Certbot after successful challenge is creating certificates in the past Help	17	1168	May 7, 2021
Migrating/renewing LetsEncrypt certificates between hosting providers Help	24	1609	March 8, 2024

Beginner Questions

Related topics