[HN Gopher] How we reduced the impact of zombie clients
___________________________________________________________________
How we reduced the impact of zombie clients
Author : jaas
Score : 67 points
Date : 2025-06-04 15:58 UTC (7 hours ago)
(HTM) web link (letsencrypt.org)
(TXT) w3m dump (letsencrypt.org)
| meltyness wrote:
| My server got renewal halted. I rolled my own wrapper for
| certbot. Idk it's just a blog, I'm not that attached. It hit some
| rock a few months ago, I just retried and manually installed it,
| and it seems to have perked back up and continued receiving
| certs. Probably would have been more frustrating if it were a
| huge fleet but, it wasn't even worth my time to check logs and
| figure out what precisely happened (cert distributed with a
| modified that didn't match the ASN.1 expiry? transient issuance
| failure? issues the same cert? ...who knows.)
| globie wrote:
| Were you running certbot multiple times per day?
|
| Looking at the relevant limit, "Consecutive Authorization
| Failures per Hostname per Account"[0], it looks like there's no
| way to hit that specific limit if you only run once per day.
|
| Ah, to think how many cronjobs are out there running certbot on
| * * * * *!
|
| [0]: https://letsencrypt.org/docs/rate-limits/#consecutive-
| author...
| bbarnett wrote:
| Isn't that where we are going eventually? Certs only lasting
| a day?
| globie wrote:
| That's a good point. I suspect as the renewal period is
| shortened, scripts will attempt renewal faster and faster.
|
| I hope they don't go any shorter than a month. Let the user
| pick, any value up to a year should do.
| conradludgate wrote:
| Browsers are eventually going to deny any certificate
| after 47 days iirc
| UltraSane wrote:
| No, they will never get that short due to reliability
| issues. I could see getting down to maybe two weeks.
|
| To make 24 hour valid certs practical you would need to
| generate them ahead of time and locally switch them out.
| This would be a lot more reliable if systems supported two
| certs with 50% overlapping validity periods at the same
| time.
| jaas wrote:
| Let's Encrypt has already started issuing a limited
| number of 6-day certs and they will be generally
| available later this year.
|
| (90 days will remain the default though)
| ferngodfather wrote:
| They simultaneously want shorter certs but can't cope with
| the current load
| greatgib wrote:
| As they have the account email, they could also notify of the
| issue by email when there are too many issues renewing for too
| long.
| xp84 wrote:
| Sure, and they must have already emailed the person when they
| failed to get a new cert before their last one expired. But I
| suspect a lot of people don't use a real email address for LE,
| since there's no enforcement/verification. Or they might be
| using one that isn't their main one.
| Macha wrote:
| Note that Lets Encrypt are winding down their email
| notifications as of today, actually:
|
| https://letsencrypt.org/2025/01/22/ending-expiration-emails/
| cibyr wrote:
| The self-service unpause is brilliant. The worst thing about
| hitting these sorts of limits is that time window when you think
| you've fixed the problem but you can't check because you're
| throttled - so there's nothing you can do but wait. Giving
| literally any affordance so that a human can make progress with a
| fix removes this huge source of frustration.
___________________________________________________________________
(page generated 2025-06-04 23:00 UTC)