Following Same Wildcard certificate on multiple servers and similar topics. Apparently, the LE/certbot infrastructure is missing a solution for distributing/renewing wildcard certificates across multiple servers without touching the Let's Encrypt API (and triggering undesirable limits). As paid 1-y…

Cool, you could also fetch from secrets vaults like Hashiscorp Vault/Azure Keyvault etc, that way it's not tied to certbot specifically.

[image] vdudouyt: First of all, you setup the usual certbot workflow on your upstream server and deploy your private key on your downstream servers once Certbot's default behavior is to create a new private key for each renewal. You will need to change that to preserve private keys to allow …

That's fine but there is no reason you have to match Certbot's frequency. It uses random times (by default). You could check at a time and frequency that makes sense for the specific server you are controlling. Certbot uses ARI so the specific date and time it renews is controlled by that (along w/…

[image] vdudouyt: I check local certificate validity period to avoid sending any requests to upstream server unless there's a due certificate that requires renewal. You can't know (fully) when a cert is due for renewal without checking ARI. The CA can set those windows as they see fit. Most…

[image] vdudouyt: RandomizedDelaySec=3600 I'd stay away from top of the hour with something like: [presuming it's being called at the top of the hour] RandomizedDelaySec=3400 RandomizedDelaySec=RandomizedDelaySec+100

[image] rg305: I'd stay away from top of the hour Perhaps consider RandomizedDelaySec=10800 to spread the load across 3H or even longer. Doing one of those twice a day spreads the requests across 6H each day. It is hard to know what time their own "upstream" server is busiest. You can't li…

Certferry - easy distribution of wildcard LE certificates - #8 by MikeMcQ - Client dev

Topic		Replies	Views	Activity
Looking for explanation for using wildcard on two servers Help	28	1417	November 21, 2021
CertBot Auto-renewal for SMTP(Exim4) and IMAP(Dovecot) Help	6	3252	January 17, 2022
Retrieving already-created wildcard cert on a different server Server	5	4066	April 25, 2018
Update wildcard certs on multiple server Help	4	2540	September 17, 2021
How should I automate? Help	33	1201	January 26, 2023