) that will make "3 1 1" rekeying painless and reliable (rekey automatically only after TLSA publication, otherwise keep using the same keys). I'll soon have a wrapper script for "certbot" (to be announced here and on the dane-users list, my twitter feed.
WEBROOT RENEWAL CODE
The only reliable way to manage "2 1 1" records is to inject a layer of indirection between the certificate files LE renews and the ones used by application, with some code to conditionally propagate the changes only if the right preconditions hold (the new chain matches the published TLSA RRs). So you're actually much better off with "3 1 1" records managed properly, than with "2 1 1" which give you an illusion of stability. Unless you pay close attention to LE pre-announcements of upcoming changes, eventually a static pin of the intermediate CA will become stale. You still need to check whether the new certificate chain from the CA has the expected issuer, before deploying it. Just be aware that intermediate CAs aren't forever.
etc/letsencrypt/live//fullchain.pem (success)Ĭhecking that the TLSA record has not changed $ cat < Changing TLSA every time a certificate is renewed is a bad process in my opinion because there are at least hours until until a full day until DNS records are renewed and in this time TLSA / DANE is not valid). Which means TLSA record does not have to be renewed every time there is a new ceritficate created (which means around every 2 months). With the dehydrated script and the option PRIVATE_KEY_RENEW="no" the cert files after renewal are not identical but if I create the TLSA records this record stays the same. I'm running into problems with changing TLSA records with certbot. Hi, I tried to switch over from dehydrated script (which sometimes causes problems with bind and I would like to have a second option) for cert renewal to certbot. output of certbot -version or certbot-auto -version if you're using Certbot): certbot 0.40.0 I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No, not for Cerbot, there is Webmin but not used for certbot I can login to a root shell on my machine (yes or no, or I don't know): Yes My hosting provider, if applicable, is: not relevant VPS with full root access The operating system my web server runs on is (include version): Ubuntu 20.04 My web server is (include version): Not relevantWEBROOT RENEWAL FULL
0 kommentar(er)
