Renewal notices for auto-renewing certs

The expiry reminders are sometimes controversial because they can have false positives when sysadmins split or merge certificates, or reissue them adding or removing names. (The expiry reminders don't treat this as a "renewal" because they don't know whether the particular changes made are or are not a comprehensive replacement for the original certificate.)

Still, I think that the huge majority of these reminders are true positives, caused by people not setting up autorenewals, or caused by the autorenewals failing somehow (often due to changed DNS records or something).

The certificate-reorganization potential false positive case is mentioned in the documentation and it would be nice if the reminder e-mails could get a little cleverer about this, but there isn't a clear way to eliminate false positives here without also increasing false negatives.

7 Likes