Member
RackNerd Amsterdam is where I keep a box. Their network to Let's Encrypt is stable but LE does rate limit on failed validations. I hit that once with a broken DNS record. Took a week to clear.
Use staging first. Always.
--stagingI am on Debian with openrc too, on a different host. I use dehydrated, it is in the repos. Light, no systemd, just a cron job or manual run. I found it simpler than acme.sh because the config is one file.
Member OP
Dehydrated looks nice but I am confused about the DNS challenge vs HTTP challenge. My nginx is public so HTTP should work right? I don't need to touch DNS?
Member
HTTP-01 works fine if port 80 is reachable and nginx serves the challenge file. DNS-01 is only for wildcards or internal hosts. For a single public domain, stay with HTTP-01.
I manage about thirty sites, mix of certbot and acme.sh depending on what the client already had. Both work. The client matters less than monitoring: I have a weekly script that checks expiry within 14 days and emails me.
This is the real answer. Automation plus alerting. I use a simple bash script that curls the cert expiry date and posts to a Telegram bot if under 7 days. No dependencies beyond openssl and curl.
Member
Following this thread. I am on systemd but considering openrc for a side project, good to see what breaks and what does not.
I used acme.sh with the init script from their wiki for six months on Devuan. Worked fine. The script was just a wrapper around the cron call, not doing anything fancy.
That is the safe approach. What I object to in some clients is background daemons phoning home for "updates" or telemetry. Shell-acme has no update channel; you download what you audit.
GDPR is not about having a checkbox, it is about not collecting data you do not need.
Can someone explain why cron is "not ideal" for ACME originally? I missed that. I have used cron with certbot for years on systemd systems, the timer is just a fancier cron.
Member
Some ACME clients moved to systemd timers because timers can express "run twice daily but only if you missed the last one" and random delays to avoid the 00:00 thundering herd. Cron can do random delays too with
sleep $((RANDOM % 3600))For a single VPS it does not matter.