2

Ive got a lets encrypt HTTPS certificate installed for a site that auto renews.

My concern is that it may fail the auto renew and visitors may be greeted with an expired certificate warning.

Whats the best way to auto check that the certificate has renewed ? I was thinking of some sort of server side cron script from a test server, but this seems a bit over the top for a problem i guess most HTTPS sites have, so wondered if there was a more straight forward approach.

  • If you already have some external monitoring of the website, this is enough to plug, any decent. remote monitoring system can check X.509 certificates expiry. Otherwise on the server itself , openssl x509 is your friend if on Unix. If you are using LE and certbot you can also check logs about renewals to see if they succeeded or failed. – Patrick Mevzek Aug 28 '18 at 15:47
  • Worth checking with your host to see whether this isn't already a thing? A host I use sends out an email if a "Let's Encrypt" cert fails to renew. – MrWhite Aug 29 '18 at 16:35
2

I use ssl-cert-check which I install through Apt under Ubuntu:

sudo apt install ssl-cert-check

I then run it in a daily cron job like:

ssl-cert-check -f /etc/ssl-check-sites.txt  | /opt/bin/ssl-check-alert.pl

Where the text file lists my domains like:

example.com 443
example.net 443

If you run ssl-cert-check it will always produce output like:

Host                                            Status       Expires      Days
----------------------------------------------- ------------ ------------ ----
example.com:443                                 Valid        Oct 3 2018   35                                 
example.net:443                                 Valid        Oct 3 2018   35       

The Perl file filters the output such that cron only sends me an email if there is a cert expiring in fewer than 25 days:

#!/usr/bin/perl

use strict;

my $full = "";
my $error = 0;

foreach my $line (<STDIN>) {
    $full.=$line;
    chomp $line;

    if ($line =~ /^[ \t]*$/){
    } elsif ($line =~ /^Host/){
    } elsif ($line =~ /^-------/){
    } elsif ($line =~ /^\s*([a-z\.]+).*\s([\-0-9]+)\s*$/){
        my ($host, $days) = ($1, $2);
        $days = 0 + $days;
        if ($days < 25){
            print "$host SSL is expiring in $days days and should be renewed\n";
            $error = 1;
        }
    } else {
        print "Can't parse: $line\n";
        $error = 1;
    }
}

if ($error){
    print "\n\n\n$full";
    exit 1;
}

I chose 25 days because LetsEncrypt certs typically renew at 30 days. That gives a few tries for them to renew on their own before I start getting alerts. 25 days is still enough time for me to fix problems manually.

  • Thanks @Stephen Ostermiller , is it a common issue for them not to renew correctly automatically, or do they tend to be quite reliable ? – sam Aug 29 '18 at 14:45
  • I haven't seen too many failures from LetsEncrypt themselves, but there is a lot that can go wrong with renewals. There has to be a cron job scheduled somewhere to do them. Cron jobs sometimes break because of software upgrades or permissions changes. Changes to your website could prevent the .well-known directory from working properly during the renewal process. I don't typically have problems but I never say no to extra alerts. – Stephen Ostermiller Aug 29 '18 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.