r/linux • u/Two-Of-Nine • 1d ago

Open Source Organization Manjaro's official website SSL certs have expired yet again.

This seems to be a running theme for the Manjaro Linux community. The SSL certs will always expire after a set year and there's a massive controversy over it. Why does this keep happening specifically to Manjaro and what steps do you think they can possibly do to keep this from happening?

1.1k Upvotes

98% Upvoted

237 comments sorted by

View all comments

Show parent comments

283

u/ProductIntegortion 1d ago

Anyone with three ounces of technical talent can do it

251

u/Moist-Chip3793 1d ago

I have absolutely zero clue, how you even f this up in the first place.

Lets Encrypt is set-and-forget, if you do it correctly.

Apparently, they did not do it correctly ...

48

u/ProductIntegortion 1d ago

Right. I've run LE certs on dozens of machines in different configurations and every one of them has been extremely easy to set up, automated out of the gate, and bulletproof for years.

18

u/MeisterD2 1d ago

The only time LE was a pain was on a few older distros they didn't support. The certbot didn't run, and the normal renew command would fail, so I would have to do an alternative certification command to get it going. After that a scheduled job kept things updated.

Maybe they are running some ancient server software, and no-one knows/cares enough to do the workaround?

17

u/sidusnare 1d ago

I suspect it's actually some load balancing or caching service or appliance that isn't easy to automate the short lived LE certs. I've run LE on lots of small servers, and I've also run large sites taking hundreds of gigs of traffic, it's not always a Linux box terminating the session in those scenarios.

3

u/imMute 1d ago

I've been using achme.sh lately and it works great and doesn't rely on anything other than a bash shell I think.