Change in Let's Encrypt Certificate Noticed by Securi Security Tool

[liannelewis]

Please fill out the fields below so we can help you better.

My domain is:

I ran this command:

It produced this output:

My operating system is (include version):

My web server is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

[schoen]

Hi @liannelewis,

These certificates expire after 90 days, and many of the tools the obtain and install them will automatically renew them for you every 60 days by obtaining and installing a fresh certificate. It’s likely that your security tool simply noticed that the certificate had changed because it was renewed. If you’d like to tell us the domain name, we can also look to see if this is the case.

[ahaw021]

hi @liannelewis

I find the whole premise of your question interesting. Let me explain why.

We setup configuration monitoring for clients. When a change is detected we usually investigate this

I believe your question should have been how can I verify that a automated renewal (which is what is the most likely case for a new certificate) is what is being detected

There are other reasons why a certificate may have changed (not saying these are it)

A) Someone has requested a new certificate outside of the expiry date
B) Someone has configured a new certificate.

Asking people on a forum whether or not you should ignore the message is the wrong approach in my opinion.

My 5 cents on how to verify this

A) Check the contents of the email and what it is actually tell you
B) Check if a new certificate has been issued for your domain here https://crt.sh/
C) Browse to your domain and check the fingerprint of the certificate
D) If you are using certbot you can check the log file and see if a renewal has been successful recently

Overall your security system is doing what it should and you should verify the change is expected

Andrei

[liannelewis]

Hi Schoen, Thank you very much for taking the time to explain this. I am just launching y first website and I am not a developer or designer so there has been a steep learning curve which you have made easier for me. Kind Regards, Lianne Lewis

[liannelewis]

Hi ahaw021, Thank you so much for taking the time to guide me along. I have now spent an hour going through your checklist and discovering exactly how to confirm, or not, if there is a problem with my security certificate. I would not have known what to do without your advice, so i wanted to acknowledge the help and let you know that you are a very generous person. I am on a steep learning curve and I need to understand this area as a matter of ensuring my website is secure. Many thanks and kind regards. Lianne Lewis