Skip to content
Register

Finally automated SSL for all client subdomains

Web Hosting by marcus_qc 24 replies 3.5K views
Fritz48

Member

Datenschutz First

7 #21

Furthermore, the Cloudflare API interaction logs personal data by definition — the IP making the request, timestamps tied to your identity. Their DPA is public, but are you, marcus_qc, listed as controller with Cloudflare as processor? For client subdomains, you are processing on behalf of others.

The absence of logging in your script is actually a problem here. You cannot demonstrate what you did not record. Art. 5(1)(d) accuracy principle — how do you verify the automation behaved correctly without logs?

Neuland. Aber schnell.
marcus_qc

Member OP

5 #22

I get it, I get it. I'm a one-person reseller in Montreal, not a trust service provider. But fine, I'll add logging. Syslog at least. And I'll read the Cloudflare DPA again, last time was 2022 — https://www.cloudflare.com.

Can we talk about the actual script problem though? The notification part. What's the simplest webhook that isn't Slack? I don't want another paid thing.

42U and still growing
KA

Member

#23

Simplest? curl to a Discord webhook if you already use it. Or the ntfy.sh that carlos2 mentioned. I use LINE Notify for my Thai clients but that's region-locked.

If you want dead simple, just mailx to your own address. Most VPS have postfix or nullmailer installed already. One line:

Echo "Cert failed for $domain" | mail -s "SSL alert" [email protected]

Not fancy. Works when everything else is broken.

kenji3

Member

7 #24

Three months clean? I had silent failures at month four.

Found my issue: acme.sh had cached a valid cert response from staging server. So it "renewed" with a fake cert. Browser showed untrusted, script showed success. Took me a week to notice because I trusted the exit code.

You should add a verify step: openssl connect to actual port 443 and check expiry there. Not just file existence.

conbini > datacenter snacks
KE

Member

#25

Or use step-ca from Smallstep and stop relying on public CA for internal stuff. But your clients need public trust, so never mind.

For notification I run a second script that checks all certs via TLS connect, independent of the renewal script. Runs hourly from different machine. If both fail, I know it's real. If only renewal fails, I know it's the automation. Split-brain monitoring, basically.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft