However the last couple of days I’ve been getting email notifications that some of my sub-domains are expiring.
My understanding was that certbox should be attempting to auto-renew the certs based on the cron job that gets created:
matt@yoshi:~$ cat /etc/cron.d/certbot
# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc. Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
Am I missing something here?
FYI - Using sub-domain method rather than wildcard because my DNS provider doesn’t allow txt records for certbox to work.
It sounds like you probably had different certificates which have been deleted or replaced, and they’re expiring, even if your current certificate(s) are okay.
Edit: Also, what does “sudo certbot certificates” show?
Ah yip. Yeah - that did cross my mind. I just wasn’t entirely sure what command[s] I should use to verify.
I see my actual cert I’m using is valid from Monday, 18 June 2018 to Sunday, 16 September 2018. So despite the emails, everything does look good.
Correct. https://www.techlife.nz/ is using the techlife.nz certificate. Unless you're using the www.techlife.nz certificate with some other software, you can delete it, with:
sudo certbot delete --cert-name www.techlife.nz
An HTTPS website needs a valid certificate for its own name, whether or not it's serving an HTTP redirect elsewhere.
https://www.docker.techlife.nz/ uses an invalid certificate (the techlife.nz one) and serves some HTML page instead of a redirect.
(Some browsers will ignore that issue for "www" subdomains.)
So you can't delete the www.docker.techlife.nz certificate if you want https://www.docker.techlife.nz/ to work. On the other hand, at the moment the www.docker.techlife.nz certificate isn't actually being used and https://www.docker.techlife.nz/ doesn't work anyway, so you can delete it without the situation getting any worse.
I'd suggest getting a new techlife.nz certificate for all the current names plus www.docker.techlife.nz, adjusting the web server configuration, and deleting the old www.docker.techlife.nz certificate.
The www.docker.techlife.nz issue aside, it looks like you're all good regarding expiration and renewal.
What subdomains and certificates did the email(s) warn about?
Picking a random example, if it was gitlab.techlife.nz:
So for that subdomain, you probably deleted/replaced the old gitlab.techlife.nz certificate long ago and everything's good. You still get the warning email because Let's Encrypt doesn't know any better, but you could safely ignore it.
By the way, all of this data gets published in the Certificate Transparency log, so the existence of the other subdomains isn't hidden from the public.
