Expired Disarchive certificate

Expired Disarchive certificate

[Clark Fischer]

Good morning,

I recently attempted to lint a package declaration I've been working on,
and it warned about disarchive.guix.gnu.org's SSL certificate.  Seems
that it expired on October 12, as best as I can tell. Fortunately,
`lookup-disarchive-spec' uses other mirrors, so linting works, though I
will admit I was a bit confused at first.

Thanks for the wonderful project!  Looking forward to contributing back.

Re: Expired Disarchive certificate

[Tobias Geerinckx-Rice]

Hi all, Clark,

Thanks for reporting this.

I was able to manually renew the certificate (below).  I went ahead and upgraded to ECDSA.

I'm not myself a certbot user, so I'm not sure where to make the proper structural changes.  Last I tried I think I edited some unused vestigial configuration.

Kind regards,

T G-R

Sent on the go.  Excuse or enjoy my brevity.

---
nckx@berlin ~$ sudo certbot certonly --manual -d disarchive.guix.gnu.org                        Password:                                                                                       Saving debug log to /var/log/letsencrypt/letsencrypt.log                                                                                                                                        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                 An RSA certificate named disarchive.guix.gnu.org already exists. Do you want to
update its key type to ECDSA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(U)pdate key type/(K)eep existing key type: u
Renewing an existing certificate for disarchive.guix.gnu.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Create a file containing just this data:

2hl4ITP-YUQ8GwjubFrHJm7JzFFINpVPx_il3BVlnWM.0L92hq7xCkluvkLfH4xT788boQdC7LjKBAnrnyd67Bw

And make it available on your web server at this URL:

http://disarchive.guix.gnu.org/.well-known/acme-challenge/2hl4ITP-YUQ8GwjubFrHJm7JzFFINpVPx_il3BVlnWM

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/disarchive.guix.gnu.org/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/disarchive.guix.gnu.org/privkey.pem
This certificate expires on 2025-02-10.
These files will be updated when the certificate renews.

NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
nckx@berlin ~$ sudo pkill -HUP nginx

Re: Expired Disarchive certificate

[Clark Fischer]

Hi Tobias,

Thanks for taking care of that.  Works great now!

I don't know much about the infrastructure involved, but it seems like
this will have to be re-done in February, and every ~3 months
thereafter, indefinitely.  Perhaps the certbot-service[0] could help
automate this?

Thanks,
Clark.

[0] https://guix.gnu.org/manual/devel/en/html_node/Certificate-Services.html