GuyPostington

So what starts?

Here's the boulder CA function that generates serials https://github.com/letsencrypt/boulder/blob/master/ca/ca.go#...

Being good at catching errors doesn't soften the blow of the errors being so readily occurring in the first place.

Yes it does. If you can see the errors you can change your usage pattern or request a rate limit override. Flying blind is the worst way to go!

:)

You know you could monitor your certs to verify that your client is functioning correctly. There's also notification emails if you provide your email address at issuance time.

Ways to monitor for cert expiry in no particular order:

1) Prometheus + blackbox_exporter https://www.robustperception.io/get-alerted-before-your-ssl-...

2) Sensu/Nagios https://github.com/sensu-plugins/sensu-plugins-http/blob/mas...

3) Openssl in a crontab:

    echo | openssl s_client -connect ${DOMAIN}:443 -servername ${DOMAIN} -verify_hostname ${DOMAIN} 2>/dev/null | openssl x590 -noout -startdate -enddate

You're funny.

The parent stated that you can run your own DNS server temporarily for the cost of the hardware to run the server and shut the DNS server off after the certificate has been issued. The cost is basically free.

You should check out https://community.letsencrypt.org and ask for help there!

Here you go, read the source. https://raw.githubusercontent.com/letsencrypt/website/master...

Can you give some more insight on what happened to the team managing openssl during that time? I remember being on-call at a job when the news dropped.

This is the internet as I remember it.

You could help too if you choose to contribute to this project! https://github.com/tdelmas/Let-s-Clone

To help produce an LE2, please contribute to https://github.com/tdelmas/Let-s-Clone

You should post on the community forum if you ever experience an issue like that again. Https://community.letsencrypt.org

Something similar exists for Sensu too https://github.com/sensu-plugins/sensu-plugins-http/blob/mas...

   $ echo | openssl s_client -connect "www.certera.io":443 -servername "www.certera.io" -verify_hostname "www.certera.io" 2>/dev/null | openssl x509 -noout -issuer
   issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA

   $ echo | openssl s_client -connect "certera.io":443 -servername "certera.io" -verify_hostname "certera.io" 2>/dev/null | openssl x509 -noout -issuer
   issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3

That's exactly why you should read the book. It's less so about motorcycle than you think.

Can you show this off? It sounds like something I need to have in my life. What TSDB did you use? What did your conversion from rtl_433 to a metric look like?

Can you give an example of this garbage?

Can you give an example of the half baked-ness please?

I used Ansible in pull mode (https://docs.ansible.com/ansible/latest/cli/ansible-pull.htm...) in my UserData for several years. I've since left that company, but the implementation still powers their infrastructure. I had Ansible emit slack notifications when it started and completed. If the initial deploy ever failed, the node would eventually fail a healthcheck and that server would be destroyed and throw a different slack notification via an autoscaling group lifecycle monitor.

I can assure you this was not a tick box operation.

Probably. What matters is the community response to the outage though. From what I saw there's been a ton of love for the team working through an entire Sunday.

This links directly to a PDF. Reader beware.

The name is great.

Last thing, let me pet the cat in the first room.

You should put a TLS cert on http://enceladusgame.io/playtest

You can store the cert and key in a key/val store and each EC2 server would only need to renew the cert.

What's your program called and how can I test it out? I use LibreCAD which is 2D, but I wish there were more shortcut key combos.