social.coop is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Fediverse instance for people interested in cooperative and collective projects. If you are interested in joining our community, please apply at https://join.social.coop/registration-form.html.

Administered by:

Server stats:

488
active users

#certbot

4 posts4 participants0 posts today

"When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or more. With 4.0, Certbot is now supporting Let’s Encrypt’s new capability for six day certificates through ACME profiles and dynamic renewal at:

- 1/3rd of lifetime left
- 1/2 of lifetime left, if the lifetime is shorter than 10 days"

eff.org/deeplinks/2025/04/cert

Electronic Frontier Foundation · Certbot 4.0: Long Live Short-Lived Certs!When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or...

Hello folks,

I run #certbot 3.1.,.1 on #FreeBSD and I have an issue:
File "/usr/local/lib/python3.11/site-packages/certbot/crypto_util.py", line 185, in <module>
) -> Tuple[acme_crypto_util.Format, util.CSR, List[str]]:
^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'acme.crypto_util' has no attribute 'Format'

I'm not a #python dev and I need help to solve This issue.

Could some ome help me?

Haven’t used Certbot for a very long time, and right now start cleaning older certificates on a old server to start preparing migration, and now I noticed this really weird, stupid and mostly dangerous behavior: if you use the command `revoke`, it won’t ask if you are sure if you want to revoke the certificate, but it will ask you if you want to delete the certificate locally…. The revoke step is COMPLETELY SILENT.

Replied in thread

@kzimmermann

This is what I get from chrome mobile, a bit more descriptive

I wonder why Firefox mobile and Chrome mobile are barfing up on the certificate expiration date, while it will clearly expire on the 20th of March, a number of days into the future; are these browsers now clairvoyant?

Both are different Androids with a clock synchronized properly

I started a discussion with fellow #sysadmin about updating #BIND / #named config to migrate from the overly permissive allow-update {…} stanzas to the more restricted update-policy {…} stanzas using targeted grant statements.

The idea being to allow the #acme client to only be able to update (add / delete) _acme-challenge TXT instead of any record in the zone.

Old:

allow-update {
TSIG_KEY_NAME;
};

New:

update-policy {
grant TSIG_KEY_NAME name _acme-challenge.example.net TXT;
};