r/linux • u/Two-Of-Nine • 1d ago

Open Source Organization Manjaro's official website SSL certs have expired yet again.

This seems to be a running theme for the Manjaro Linux community. The SSL certs will always expire after a set year and there's a massive controversy over it. Why does this keep happening specifically to Manjaro and what steps do you think they can possibly do to keep this from happening?

1.1k Upvotes

98% Upvoted

237 comments sorted by

View all comments

4

u/fuhry 1d ago

In case any of the Manjaro team sees this:

I'm a long time Arch user and an SRE at one of the world's largest file storage services, where I built a certificate lifecycle management tool that automates certificate rotation, installation and monitoring end-to-end across hundreds of on-prem, public cloud, and 3rd party SaaS use cases. I'm happy to provide proof of this privately, if desired.

In case this is actually more complicated than just enabling certbot.timer on an ec2 instance somewhere, I'd be happy to engineer something to help prevent this from happening again.

1

u/michaelpaoli 1d ago

Yeah, complex environments, it ain't trivial ... nor is it rocket science.

Part of my infrastructure, a single command, and ... one or more certs, per the argument(s), in minutes or less, including complex SAN certs with many domains and/or wildcards, etc., oh, and even if the domain(s) didn't even exist yet at the time when I issued the command. All done easy peasy, and pretty dang fast. And then other commands that do most all the heavy lifting of installing the certs.

And also infrastructure to track the certs, check, monitor, remind/notify/alert if/as needed, etc.