Confusion over Certsage and email notifications

[tcmullet]

My domain is: TomsGoodFiles.com

I've been running Certsage.php for over a year. Lately I've been getting emails saying LetsEncrypt will no longer be sending emails to notify that my SSL is about to expire. I'm confused. Each time I run Certsage.php (which is less than 90 days unless I'm late), it prompts me for one or more email addresses that will receive warnings when my 90 days is nearly up. Is LetsEncrypt saying that THOSE email notifications will no longer happen, even though I put them in every time I renew using Certsage?? If yes, then (1) will running Certsage and including email addresses simply ignore them and not send me anything (such that entry of the addresses is superfluous)? and (2) is there any reason why I can't still renew with Certsage but schedule it manually on my own (via writing it down on my to-do list on a date 2.5 months down the road in my Daytimer)?

[petercooperjr]

@tcmullet

Is LetsEncrypt saying that THOSE email notifications will no longer happen, even though I put them in every time I renew using Certsage??

Yes. I'm sure that Certsage will be getting an update at some point in order to explain things a little clearer. All Certsage is doing is sending the email address to the Certificate Authority (the CA, Let's Encrypt in this case), but the CA can choose what it wants to do with it. And the CA wants to (in order to help protect your privacy) no longer hold the data of which domain names are associated with which email addresses.

@tcmullet

If yes, then (1) will running Certsage and including email addresses simply ignore them and not send me anything (such that entry of the addresses is superfluous)?

The first time with a new account, Let's Encrypt is planning on sending an introduction email with information on how to subscribe to their general-announcement email lists, but yes in general it won't matter if you put an email in there or not, especially for renewals.

@tcmullet

(2) is there any reason why I can't still renew with Certsage but schedule it manually on my own (via writing it down on my to-do list on a date 2.5 months down the road in my Daytimer)?

Yes, you should all along be monitoring your system and ensuring renewals happen rather than relying on Let's Encrypt's reminder emails. I would actually recommend an appointment every two months on your calendar if you need to renew manually, just to ensure that you have time to deal with problems or vacations or whatever. You may also want to upgrade to the latest version of Certsage, which tries to renew your certificates automatically. (Though adding one of the external monitoring solutions that Let's Encrypt recommends as a replacement for their emails might not be a bad idea too.)

[griffin]

Adding to @petercooperjr's already excellent observations and suggestions:

• You don't actually need to enter email addresses every time. I should have made that more clear in the instructions. After you enter them once, you've signed up for what Let's Encrypt has to offer, such as expiration notifications, but those are going away soon as @petercooperjr already pointed out.
• There's some discussion going on in this community right now (and I suspect within LE itself) about exactly what the email address submission will do in terms of repeated entry. Given that the plan is as @petercooperjr described where submitted email addresses will no longer be stored in association with an ACME account, I surmise that any addresses submitted could be forwarded to LE's mailing system and possibly added to a set of lists, but I'm not sure at present.
• You can always operate CertSage completely independently of any email address submissions or notifications, so in that regard the email address submissions and notifications are superfluous. For now you can even remove all associated email addresses from your ACME account via submitting an empty list of email addresses, should you so desire. CertSage will continue operating in exactly the same manner.
• I support in the strongest way possible @petercooperjr's suggestion of updating to the latest version of CertSage, which supports certificate autorenewal, provides certificate lifetime information onscreen, and offers more-modern ECDSA private keys in addition to the traditional RSA private keys you are used to getting from CertSage.
• I recently published a lengthy tutorial explaining how to use CertSage with multiple domain names hosted within a single cPanel account, which is linked in its own section on the page for the latest version of CertSage. This could prove useful in checking your setup to determine if you're getting the most out of CertSage.