joshuacwnewton
commented
1 year ago From what I can tell from the documentation, Discourse uses acme.sh for cert renewal (as opposed to, say, certbot). Plus, setting up Discourse should automatically enable a cron job that will run acme.sh:
At the same time, it adds a cron job that runs a daily cert renewal check. This will automatically renew your cert. Nothing happens if cert has not expired. If the certificate does expire, you’ll get an email about it from Let’s Encrypt at the email address you provided during setup.
I checked our app.yml config file, and everything appears to be setup correctly for LetsEncrypt/SSL:
## Uncomment these two lines if you wish to add Lets Encrypt (https)
- "templates/web.ssl.template.yml"
- "templates/web.letsencrypt.ssl.template.yml"
## which TCP/IP ports should this container expose?
## If you want Discourse to share a port with another webserver like Apache or nginx,
## see https://meta.discourse.org/t/17247 for details
expose:
- "80:80" # http
- "443:443" # https
[...]
## If you added the Lets Encrypt template, uncomment below to get a free SSL certificate
LETSENCRYPT_ACCOUNT_EMAIL: neuropoly-admin@liste.polymtl.caYet, we've never received an email at "neuropoly-admin@liste.polymtl.ca" about a LetsEncrypt expiry. Very curious!
jcohenadad
This issue is tangential to https://github.com/spinalcordmri/spinalcordmri.github.io/issues/79. That issue is about monitoring email outages of any kind. However, to mitigate outages specifically related to SSL certificate renewal, we should get to the bottom of why the SSL certificate failed to auto-renew in the first place.
1st outage
The expiry date for the very first cert (first email outage) was:
This seems to line up with when emails began getting dropped:
This outage was caught and fixed on May 11th, 2023.
2nd outage
After renewal, the expiry date for the new cert (i.e. second email outage) was:
This doesn't quite make sense to me, as LetsEncrypt SSL certs should last for 90 days. May 11th + 90 days = August 9th, which is also when the forum began dropping emails a second time:
The second outage was caught and fixed on August 18th, 2023.
Next outage
If we check the current cert, we see:
This is again a bit strange, since August 18th + 90 days = November 16th instead. Still, even if the auto-renewal issues are fixed, we should keep an eye out on these various dates, and perhaps set up some sort of reminder.